UpHeron
All vulnerabilities

Servers and applications

CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Severity
High 7.0
Published
27 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 10.1.0-milestone8
  • Version 10.1.0-milestone7
  • Version 10.1.0-milestone6
  • Version 10.1.0-milestone5
All 17 release lines
  • From 8.5.55 up to 8.5.73
  • From 9.0.35 up to 9.0.56
  • Version 10.0.0-milestone5
  • Version 10.0.0-milestone6
  • Version 10.0.0-milestone7
  • Version 10.0.0-milestone8
  • Version 10.0.0-milestone9
  • Version 10.0.0-milestone10
  • From 10.0.1 up to 10.0.14
  • Version 10.1.0-milestone1
  • Version 10.1.0-milestone2
  • Version 10.1.0-milestone3
  • Version 10.1.0-milestone4
  • Version 10.1.0-milestone5
  • Version 10.1.0-milestone6
  • Version 10.1.0-milestone7
  • Version 10.1.0-milestone8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-23181
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-23181