CVE-2022-23181
Local privilege escalation with FileStore
- State
- Published
- Severity
- Not scored
- Published
- Jan 27, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jan 12, 2022
Description
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Scores
The record has no CVSS score.
Weaknesses
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected Products
| Product | Versions |
|---|---|
Apache TomcatApache Software Foundation |
|
References
- https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220217-0010/
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20221026 [SECURITY] [DLA 3160-1] tomcat9 security updatemailing-list
- DSA-5265vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.