Read the docs
TI-2022-07334 Aliases CVE-2022-23181GHSA-9f3j-pm6f-9fm5

Local privilege escalation with FileStore

Priority LOW 32CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Why it matters now

EPSS 0.00692 53rd percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.0.16, 9.0.58, 8.5.75Red Hat: 4 advisoriesRed Hat: 6 fixed, 10 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TomcatApache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8; Apache Tomcat 10.0 10.0.0-M5 to 10.0.14; Apache Tomcat 9 9.0.35 to 9.0.56; Apache Tomcat 8 8.5.55 to 8.5.73—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)10.0.0 to before 10.0.1610.0.16Patch availableGHSA-9f3j-pm6f-9fm5
—org.apache.tomcat:tomcat (Maven)9.0.0 to before 9.0.589.0.58Patch availableGHSA-9f3j-pm6f-9fm5
—org.apache.tomcat:tomcat (Maven)before 8.5.758.5.75Patch availableGHSA-9f3j-pm6f-9fm5
  • Apache Tomcat VendorApache Affected Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8; Apache Tomcat 10.0 10.0.0-M5 to 10.0.14; Apache Tomcat 9 9.0.35 to 9.0.56; Apache Tomcat 8 8.5.55 to 8.5.73 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0 to before 10.0.16 Fixed in 10.0.16 Patch available GHSA-9f3j-pm6f-9fm5
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0 to before 9.0.58 Fixed in 9.0.58 Patch available GHSA-9f3j-pm6f-9fm5
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected before 8.5.75 Fixed in 8.5.75 Patch available GHSA-9f3j-pm6f-9fm5

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*8.5.55 – 8.5.73; 9.0.35 – 9.0.56; 10.0.1 – 10.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*10.0.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*10.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*10.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*10.0.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*10.0.0 milestone8VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*10.0.0 milestone9VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*10.1.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*10.1.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*10.1.0 milestone3VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.55 – 8.5.73; 9.0.35 – 9.0.56; 10.0.1 – 10.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:* Versions 10.0.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* Versions 10.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:* Versions 10.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:* Versions 10.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:* Versions 10.0.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:* Versions 10.0.0 milestone9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:* Versions 10.1.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:* Versions 10.1.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:* Versions 10.1.0 milestone3 Vulnerable ·Apache
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*10.1.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*10.1.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*10.1.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*10.1.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*10.1.0 milestone8VulnerableApache
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*8.0.8.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*8.0.8.3.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 8.0.29VulnerableOracle
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:* Versions 10.1.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:* Versions 10.1.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:* Versions 10.1.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:* Versions 10.1.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:* Versions 10.1.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.29 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-9f3j-pm6f-9fm5 org.apache.tomcat:tomcat (Maven) Fixed in 10.0.16 Advisory →
  • Fix · GHSA-9f3j-pm6f-9fm5 org.apache.tomcat:tomcat (Maven) Fixed in 9.0.58 Advisory →
  • Fix · GHSA-9f3j-pm6f-9fm5 org.apache.tomcat:tomcat (Maven) Fixed in 8.5.75 Advisory →

Red Hat 4 advisories

  • RHSA-2023:0272 Released 2023-02-06 · Red Hat rating Moderate
    Red Hat support for Spring Boot 2.7.2.SP1 security update
    • Spring Boot 2.7.2.SP1
  • RHSA-2022:7272 Released 2022-11-02 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.7.0 release and security update
    • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-ecj-4.20.0-1.redhat_00002.1.el7jws, jws5-tomcat-9.0.62-9.redhat_00005.1.el7jws, jws5-tomcat-admin-webapps-9.0.62-9.redhat_00005.1.el7jws +11
    • Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-ecj-4.20.0-1.redhat_00002.1.el8jws, jws5-tomcat-9.0.62-9.redhat_00005.1.el8jws, jws5-tomcat-admin-webapps-9.0.62-9.redhat_00005.1.el8jws +9
    • Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-1-8.el9jws, jws5-ecj-4.20.0-1.redhat_00002.1.el9jws, jws5-javapackages-tools-3.4.1-5.15.11.el9jws +18
  • RHSA-2022:7273 Released 2022-11-02 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.7.0 release and security update
    • JWS 5.7.0
Show 1 more Red Hat advisories
  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
JWS 5.7.0Fixed RHSA-2022:7273
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat JBoss Web Server 5.7 for RHEL 7 ServerFixed RHSA-2022:7272
Red Hat JBoss Web Server 5.7 for RHEL 8Fixed RHSA-2022:7272
Red Hat JBoss Web Server 5.7 for RHEL 9Fixed RHSA-2022:7272
Spring Boot 2.7.2.SP1Fixed RHSA-2023:0272
Not affected: 6 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server
  • Red Hat JBoss Web Server 5.7 for RHEL 8
  • Red Hat JBoss Web Server 5.7 for RHEL 9
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23181
  2. 2026-10-03 Alias added: GHSA-9f3j-pm6f-9fm5

References

Patch 2

Advisory 5

Other 2

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences