CVE-2022-23181: Local privilege escalation with FileStore

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-27 · updated 2026-06-17
Weakness: CWE-367

Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Affected products

Apache Tomcat: from 8.5.55 through 8.5.73; from 9.0.35 through 9.0.56; from 10.0.1 through 10.0.14; 10.0.0-milestone10, 10.0.0-milestone5, 10.0.0-milestone6, 10.0.0-milestone7, 10.0.0-milestone8, 10.0.0-milestone9 (+8)
Debian Linux: 10.0, 11.0
Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
Oracle Communications Cloud Native Core Policy: 1.15.0
Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
Oracle Corporation Oracle Managed File Transfer: 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation MySQL Enterprise Monitor: through 8.0.29

References

Get alerted when CVE-2022-23181 or the next vulnerability affects your stack