Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-9f3j-pm6f-9fm5
Advisory ID github_osv/GHSA-9f3j-pm6f-9fm5
Aliases CVE-2022-23181
Summary Race condition in Apache Tomcat The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Status Published
Exploitability 0.5
Weighted Severity 6.3
Risk 3.1
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
System Score Found at
cvssv3.1 7.0 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-9f3j-pm6f-9fm5/GHSA-9f3j-pm6f-9fm5.json
generic_textual HIGH
Reference id Reference type URL
https://github.com/apache/tomcat
https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
https://security.netapp.com/advisory/ntap-20220217-0010
cpuapr2022.html Other https://www.oracle.com/security-alerts/cpuapr2022.html
cpujul2022.html Other https://www.oracle.com/security-alerts/cpujul2022.html
CVE-2022-23181 https://nvd.nist.gov/vuln/detail/CVE-2022-23181
dsa-5265 Advisory https://www.debian.org/security/2022/dsa-5265
msg00029.html Mailing List https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-9f3j-pm6f-9fm5/GHSA-9f3j-pm6f-9fm5.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.