High severity · published Jan 27, 2022
CVE-2022-23181
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to…
7.0
CVSS
0.7%
EPSS
No
On KEV
Description
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
8.5.55 through 8.5.73; 9.0.35 through 9.0.56; 10.0.1 through 10.0.14; 10.0.0; 10.0.0; 10.0.0; +11 more · source: NVD
AE
Agile Engineering Data Management · Oracle
6.2.1.0 · source: NVD
CC
Communications Cloud Native Core Policy · Oracle
1.15.0 · source: NVD
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
FS
Financial Services Crime And Compliance Management Studio · Oracle
8.0.8.2.0; 8.0.8.3.0 · source: NVD
MF
Managed File Transfer · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 8.0.29 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23181
Mailing List
https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
Mailing List
https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220217-0010/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5265
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
https://www.oracle.com/security-alerts/cpujul2022.html
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g