7
CVSSv3

CVE-2022-23181

Published: 27/01/2022 Updated: 07/11/2022
CVSS v2 Base Score: 3.7 | Impact Score: 6.4 | Exploitability Score: 1.9
CVSS v3 Base Score: 7 | Impact Score: 5.9 | Exploitability Score: 1
VMScore: 330
Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P

Vulnerability Summary

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local malicious user to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache tomcat 10.0.0

apache tomcat 10.1.0

apache tomcat

oracle managed file transfer 12.2.1.3.0

oracle agile engineering data management 6.2.1.0

oracle managed file transfer 12.2.1.4.0

oracle mysql enterprise monitor

oracle communications cloud native core policy 1.15.0

oracle financial services crime and compliance management studio 8.0.8.2.0

oracle financial services crime and compliance management studio 8.0.8.3.0

debian debian linux 10.0

debian debian linux 11.0

Vendor Advisories

Synopsis Moderate: Red Hat JBoss Web Server 570 release and security update Type/Severity Security Advisory: Moderate Topic Red Hat JBoss Web Server 570 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft WindowsRed Hat Product Security has rated this release as having a security impact ...
Synopsis Moderate: Red Hat JBoss Web Server 570 release and security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat JBoss Web Server 57 on Red Hat Enterprise Linux versions ...
Synopsis Moderate: Red Hat support for Spring Boot 272SP1 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Application RuntimesRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, whic ...
Synopsis Important: Red Hat Fuse 7110 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 710 to 711) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update ...
Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine CVE-2021-43980 The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9047 onwards exposed a long standing (but extremely hard to trigger) concurrency bug that could cause client connec ...
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 1010-M1 to 1010-M8, 1000-M5 to 10014, 9035 to 9056 and 8555 to 8573 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using This issue is only exploitable when Tomcat is co ...
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 1010-M1 to 1010-M8, 1000-M5 to 10014, 9035 to 9056 and 8555 to 8573 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using This issue is only exploitable when Tomcat is co ...
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 1010-M1 to 1010-M8, 1000-M5 to 10014, 9035 to 9056 and 8555 to 8573 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using This issue is only exploitable when Tomcat is co ...
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 1010-M1 to 1010-M8, 1000-M5 to 10014, 9035 to 9056 and 8555 to 8573 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using This issue is only exploitable when Tomcat is co ...
ALAS-2022-233 Amazon Linux 2022 Security Advisory: ALAS-2022-233 Advisory Release Date: 2022-12-06 16:43 Pacific ...
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 1010-M1 to 1010-M8, 1000-M5 to 10014, 9035 to 9056 and 8555 to 8573 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using This issue is only exploitable when Tomcat is co ...