CVE-2022-23181

moderate-risk
Published 2022-01-27

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Do I need to act?

-
0.22% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.0/10 High
LOCAL / HIGH complexity

Affected Products (20)

Affected Vendors

Debian Apache Oracle

References (12)

Mailing List https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
Mailing List https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20220217-0010/
Third Party Advisory https://www.debian.org/security/2022/dsa-5265
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujul2022.html
Mailing List https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
Mailing List https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20220217-0010/
Third Party Advisory https://www.debian.org/security/2022/dsa-5265
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujul2022.html
40
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 21/34 · High