Cyber Resilience

CVE-2022-23181

High

Published: 27 January 2022

Published
27 January 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0024 46.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-23181 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Apache Tomcat. Its CVSS base score is 7.0 (High).

Operationally, ranked at the 46.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the…

more

privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

CWE(s)
CWE-367

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
tomcat
10.0.0, 10.1.0 · 8.5.55 — 8.5.73 · 9.0.35 — 9.0.56 · 10.0.1 — 10.0.14
oracle
agile engineering data management
6.2.1.0
oracle
communications cloud native core policy
1.15.0
oracle
financial services crime and compliance management studio
8.0.8.2.0, 8.0.8.3.0
oracle
managed file transfer
12.2.1.3.0, 12.2.1.4.0
oracle
mysql enterprise monitor
≤ 8.0.29
debian
debian linux
10.0, 11.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-8 Time Stamps
addresses: CWE-367

Timestamps meeting UTC or offset standards help identify TOCTOU issues through precise chronological reconstruction of check/use operations.

References