{"schema_version":"1.9.0","id":"CVE-2022-23181","published":"2022-01-27T00:00:00Z","modified":"2026-08-12T03:51:44.822913113Z","aliases":["BIT-tomcat-2022-23181","GHSA-9f3j-pm6f-9fm5"],"related":["SUSE-SU-2022:0694-1","SUSE-SU-2022:0695-1","SUSE-SU-2022:0784-1","SUSE-SU-2022:0818-1","SUSE-SU-2026:1058-1","openSUSE-SU-2022:0818-1","openSUSE-SU-2024:11864-1","openSUSE-SU-2024:13441-1"],"summary":"Local privilege escalation with FileStore","details":"The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/tomcat","events":[{"introduced":"c8a57e4a2db8e5af314bae48123fb5990da5b7a5"},{"last_affected":"e8de8521b0f88b452ac6bd79abad3aad3bcc18b6"},{"introduced":"fc2c65d390444d75412855ad0de8b878018d02dc"},{"last_affected":"af2a7a4fb2db07390362af12d0020d550abd8785"},{"introduced":"e4344b6bd67359e1690312674d83710a793f1d5b"},{"last_affected":"3bb5b5fcf02e25ae627e480937e755e0a99c82d7"},{"introduced":"9826be4c8368c94eab1e804b456867ca1cb766c3"},{"last_affected":"cd53876fefaa370c31466b0f615e9ad026541a27"}],"database_specific":{"cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.5.55"},{"last_affected":"8.5.73"},{"introduced":"9.0.35"},{"last_affected":"9.0.56"},{"introduced":"10.0.1"},{"last_affected":"10.0.14"},{"introduced":"10.0.0-milestone10"},{"last_affected":"10.0.0-milestone10"},{"introduced":"10.0.0-milestone5"},{"last_affected":"10.0.0-milestone5"},{"introduced":"10.0.0-milestone6"},{"last_affected":"10.0.0-milestone6"},{"introduced":"10.0.0-milestone7"},{"last_affected":"10.0.0-milestone7"},{"introduced":"10.0.0-milestone8"},{"last_affected":"10.0.0-milestone8"},{"introduced":"10.0.0-milestone9"},{"last_affected":"10.0.0-milestone9"},{"introduced":"10.1.0-milestone1"},{"last_affected":"10.1.0-milestone1"},{"introduced":"10.1.0-milestone2"},{"last_affected":"10.1.0-milestone2"},{"introduced":"10.1.0-milestone3"},{"last_affected":"10.1.0-milestone3"},{"introduced":"10.1.0-milestone4"},{"last_affected":"10.1.0-milestone4"},{"introduced":"10.1.0-milestone5"},{"last_affected":"10.1.0-milestone5"},{"introduced":"10.1.0-milestone6"},{"last_affected":"10.1.0-milestone6"},{"introduced":"10.1.0-milestone7"},{"last_affected":"10.1.0-milestone7"},{"introduced":"10.1.0-milestone8"},{"last_affected":"10.1.0-milestone8"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["10.0.0-milestone10","10.0.0-milestone5","10.0.0-milestone6","10.0.0-milestone7","10.0.0-milestone8","10.0.0-milestone9","10.1.0-milestone1","10.1.0-milestone2","10.1.0-milestone3","10.1.0-milestone4","10.1.0-milestone5","10.1.0-milestone6","10.1.0-milestone7","10.1.0-milestone8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23181.json"}}],"references":[{"type":"WEB","url":"https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23181.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23181"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220217-0010/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2022/dsa-5265"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html"}],"database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-367"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23181.json","unresolved_ranges":[{"extracted_events":[{"introduced":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8"},{"last_affected":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8"},{"introduced":"Apache Tomcat 10.0 10.0.0-M5 to 10.0.14"},{"last_affected":"Apache Tomcat 10.0 10.0.0-M5 to 10.0.14"},{"introduced":"Apache Tomcat 9 9.0.35 to 9.0.56"},{"last_affected":"Apache Tomcat 9 9.0.35 to 9.0.56"},{"introduced":"Apache Tomcat 8 8.5.55 to 8.5.73"},{"last_affected":"Apache Tomcat 8 8.5.55 to 8.5.73"}],"source":"AFFECTED_FIELD"}]}}