CVE-2022-23181

Katalog CVE

CVSS 7.0 · High EPSS 0,69%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada apache tomcat, oracle agile engineering data management +5 lainnya. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Rincian

Terbit di NVD

27 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9 mailing list · mitigasi · advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220217-0010/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5265 advisory pihak ketiga