NetSight
IP …
high7.0

CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to …

Impact

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Affected products

VendorProductAffected versions
ApacheTomcat
from 8.5.55 through 8.5.73
from 9.0.35 through 9.0.56
from 10.0.1 through 10.0.14
Versions 10.0.0, 10.1.0
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleCommunications Cloud Native Core Policy
Version 1.15.0
OracleFinancial Services Crime And Compliance Management Studio
Versions 8.0.8.2.0, 8.0.8.3.0
OracleManaged File Transfer
Versions 12.2.1.3.0, 12.2.1.4.0
OracleMysql Enterprise Monitor
through 8.0.29
DebianDebian Linux
Versions 10.0, 11.0

Weakness classification

CWE-367

References