CVE-2022-23181

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-23181
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23181.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-23181
Aliases
Downstream
Related
Published
2022-01-27T13:15:08.060Z
Modified
2026-03-20T11:53:42.526828Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
c8a57e4a2db8e5af314bae48123fb5990da5b7a5
Last affected
e8de8521b0f88b452ac6bd79abad3aad3bcc18b6
Introduced
fc2c65d390444d75412855ad0de8b878018d02dc
Last affected
af2a7a4fb2db07390362af12d0020d550abd8785
Introduced
e4344b6bd67359e1690312674d83710a793f1d5b
Last affected
3bb5b5fcf02e25ae627e480937e755e0a99c82d7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9826be4c8368c94eab1e804b456867ca1cb766c3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b3a208c6d6d01c553178c5e718e750b0eb318151
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
27f7ef8cd0c637b700d564ec20f6ff92901f6b5c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c549413165721180b15f62033c1be6c5970028fd
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b3f5e0d88336d81a61a767fc10ab06930c9587ee
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6f143d19d151620cd0bfe9ec2ffa429e36ad0e45
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f2ab9ac8bc3f40ee9b2cb50b030c99df927f0429
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0e59fedb28df646930c5aff945159b64d7a52260
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8778a44d6323c1066237043a89ab2f36696916b1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e706972942e2c342e4a37baf5e2596f11e8a0e94
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2a10c8d9110d7b1c7f526f3352648c6b19ba2c52
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
51d1031c36c0f2b3ee1e0d14b56228a559144153
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0f3f1e439a040068b741d77777766722e4420ad6
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
cd53876fefaa370c31466b0f615e9ad026541a27
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4c8b650437e2464c1c31c6598a263b3805b7a81f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
56e547d387ab49f688c93fe9ca082b1b5d94deed
Database specific 
{
    "versions": [
        {
            "introduced": "8.5.55"
        },
        {
            "last_affected": "8.5.73"
        },
        {
            "introduced": "9.0.35"
        },
        {
            "last_affected": "9.0.56"
        },
        {
            "introduced": "10.0.1"
        },
        {
            "last_affected": "10.0.14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0.0-milestone10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0.0-milestone5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0.0-milestone6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0.0-milestone7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0.0-milestone8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0.0-milestone9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0-milestone1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0-milestone2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0-milestone3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0-milestone4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0-milestone5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0-milestone6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0-milestone7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0-milestone8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "11.0"
        }
    ]
}

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.2.1.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.15.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.8.2.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.8.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.1.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.1.4.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.29"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23181.json"