CVE-2022-23181

Local privilege escalation with FileStore

En bref

Sévérité: Non disponible
EPSS: EPSS 0.69 % · centile 53 (2026-10-27)
État: PUBLISHED
Publiée: 2022-01-27
Mise à jour: 2024-08-03
Attribuée par: apache
Statut NVD: Modified

Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	LOW 3.7	AV:L/AC:H/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-367

Avis

GHSA-9f3j-pm6f-9fm5 — Race condition in Apache Tomcat

Références européennes

ENISA EUVD · EUVD-2022-0937
GCVE · GCVE-0-2022-23181

Avis du CERT-FR

CERTFR-2024-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-345 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
CERTFR-2022-AVI-082 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.5.55 ≤ 8.5.73
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 9.0.35 ≤ 9.0.56
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 10.0.1 ≤ 10.0.14
cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* ≤ 8.0.29
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Apache Software Foundation · Apache Tomcat	affected Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8 ; affected Apache Tomcat 10.0 10.0.0-M5 to 10.0.14 ; affected Apache Tomcat 9 9.0.35 to 9.0.56 ; affected Apache Tomcat 8 8.5.55 to 8.5.73

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD