CVE-2022-23181

Aliases:GHSA-9f3j-pm6f-9fm5BIT-tomcat-2022-23181
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 27 Jan 2022, 00:00
Last modified:03 Aug 2024, 03:36

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7 HIGH
v3.1 (nvd)
EPSS Score
0.24% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Jan 2022, 00:00
Published
Vulnerability first disclosed
03 Aug 2024, 03:36
Last Modified
Vulnerability information updated

Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•LOW•Score: 3.7AV:L/AC:H/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.24%• Percentile: 47%

Techniques & Countermeasures

  • CWE-367•Time-of-check Time-of-use (TOCTOU) Race Condition

    The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Affected Systems

  • apache software foundation•apache tomcat

    Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8 | Apache Tomcat 10.0 10.0.0-M5 to 10.0.14 | Apache Tomcat 9 9.0.35 to 9.0.56 | Apache Tomcat 8 8.5.55 to 8.5.73

  • Unknown•Tomcat

    ≥ 8.5.55, ≤ 8.5.73 | ≥ 9.0.35, ≤ 9.0.56 | ≥ 10.0.1, ≤ 10.0.14 | 10.0.0:milestone10 | 10.0.0:milestone5 | 10.0.0:milestone6 | 10.0.0:milestone7 | 10.0.0:milestone8 | 10.0.0:milestone9 | 10.1.0:milestone1 | 10.1.0:milestone2 | 10.1.0:milestone3 | 10.1.0:milestone4 | 10.1.0:milestone5 | 10.1.0:milestone6 | 10.1.0:milestone7 | 10.1.0:milestone8

  • debian•debian_linux

    10.0 | 11.0

  • org.apache.tomcat•tomcat

    ≥ 10.0.0, < 10.0.16 | ≥ 9.0.0, < 9.0.58 | < 8.5.75

  • oracle•agile_engineering_data_management

    6.2.1.0

  • oracle•communications_cloud_native_core_policy

    1.15.0

  • oracle•financial_services_crime_and_compliance_management_studio

    8.0.8.2.0 | 8.0.8.3.0

  • oracle•managed_file_transfer

    12.2.1.3.0 | 12.2.1.4.0

  • oracle•mysql_enterprise_monitor

    ≤ 8.0.29

References (9)