CVE-2022-23181

 

Published at: - 27-01-2022 02:15

Last modified: - 26-10-2022 05:15

Total changes: - 9

Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
• https://security.netapp.com/advisory/ntap-20220217-0010/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• N/A-Patch, Third Party Advisory
• [debian-lts-announce] 20221026 [SECURITY] [DLA 3160-1] tomcat9 security update-

 

Keywords

NVD

 

CVE-2022-23181

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures