DEBIAN-CVE-2022-23181

DEBIAN-CVE-2022-23181 PUBLISHED CVSS 7 HIGH

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Risk Scores

CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Debian:14	tomcat9	0, 0, 0
Debian:13	tomcat9	0, 0, 0
Debian:11	tomcat9	9.0.43-1, 9.0.43-2~deb11u2, 9.0.43-2~deb11u3
Debian:12	tomcat9	0, 0, 0

Timeline

Jan 27, 2022 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2022-23181 advisory

Open in Interactive Console →