Local privilege escalation with FileStore

published 2022-01-27 4 y ago modified 2026-09-08 2 mo ago also BIT-tomcat-2022-23181 , EUVD-2022-0937 , GHSA-9f3j-pm6f-9fm5

cvss: 7.0; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits: 0; none known

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Patch / fix

fixed in 2 distros 5 links 2

maven org.apache.tomcat:tomcat 8.5.75, 9.0.58, 10.0.16
bitnami tomcat 8.5.74, 9.0.57, 10.0.15

debian ubuntu red hat suse opensuse

tomcat9 Debian 14, Debian 13, Debian 12 9.0.58-1

debian advisories DEBIAN-CVE-2022-23181

tomcat9 Ubuntu 20.04 LTS 9.0.31-1ubuntu0.6
tomcat8 Ubuntu Pro 16.04 LTS 8.0.32-1ubuntu1.13+esm1
tomcat8 Ubuntu Pro 18.04 LTS 8.5.39-1ubuntu1~18.04.3+esm2
tomcat9 Ubuntu Pro 18.04 LTS 9.0.16-3ubuntu0.18.04.2+esm2

ubuntu advisories UBUNTU-CVE-2022-23181

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

jws5 jboss enterprise web server 5.7 1-8.el9jws
jws5-ecj jboss enterprise web server 5.7 4.20.0-1.redhat_00002.1.el7jws
jws5-ecj jboss enterprise web server 5.7 4.20.0-1.redhat_00002.1.el8jws
jws5-ecj jboss enterprise web server 5.7 4.20.0-1.redhat_00002.1.el9jws
jws5-tomcat jboss enterprise web server 5.7 9.0.62-9.redhat_00005.1.el7jws
jws5-tomcat jboss enterprise web server 5.7 9.0.62-9.redhat_00005.1.el8jws
jws5-tomcat jboss enterprise web server 5.7 9.0.62-9.redhat_00005.1.el9jws
jws5-runtime jboss enterprise web server 5.7 1-8.el9jws

red hat advisories RHSA-2022:7272

tomcat SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +7 more 9.0.36-19.1
tomcat SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 9.0.36-3.84.1
javapackages-tools SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +7 more 5.3.1-14.5.1
tomcat SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 9.0.36-4.70.1
tomcat SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 9.0.36-3.90.1
tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.115-3.160.1

suse advisories SUSE-SU-2026:1058-1 SUSE-SU-2022:0818-1 SUSE-SU-2022:0784-1 SUSE-SU-2022:0695-1 SUSE-SU-2022:0694-1

tomcat openSUSE Tumbleweed 9.0.43-5.1
tomcat10 openSUSE Tumbleweed 10.1.14-1.1
tomcat openSUSE Leap 15.3 9.0.36-19.1

opensuse advisories openSUSE-SU-2024:11864-1 openSUSE-SU-2024:13441-1 openSUSE-SU-2022:0818-1

oracle.com/security-alerts/cpuapr2022.html advisory
oracle.com/security-alerts/cpujul2022.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23181 updated 2026-11-07 cvss 7.0

tomcat: local privilege escalation vulnerability

Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 9 pki-servlet-engine, pki-servlet-4.0-api
affected: no fix available
Red Hat JBoss Data Grid 6 jbossweb jbossweb Red Hat JBoss Data Virtualization 6 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 6 jbossweb jbossweb Red Hat JBoss Fuse 6 tomcat Red Hat JBoss Web Server 3 tomcat Red Hat OpenStack Platform 10 (Newton) opendaylight

+1 more productsfewer

Red Hat OpenStack Platform 13 (Queens) opendaylight

affected: no fix planned “Out of support scope”
Red Hat JWS 5.7.0
fixed: vendor fix RHSA-2022:7273
Red Hat Fuse 7.11
fixed: vendor fix RHSA-2022:5532
Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat 9.0.62-9.redhat_00005.1.el7jws, jws5-tomcat-lib 9.0.62-9.redhat_00005.1.el7jws, jws5-tomcat-javadoc 9.0.62-9.redhat_00005.1.el7jws, jws5-tomcat-selinux 9.0.62-9.redhat_00005.1.el7jws, jws5-tomcat-webapps 9.0.62-9.redhat_00005.1.el7jws, jws5-tomcat-java-jdk8 9.0.62-9.redhat_00005.1.el7jws, +6 more Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat 9.0.62-9.redhat_00005.1.el8jws, jws5-tomcat-lib 9.0.62-9.redhat_00005.1.el8jws, jws5-tomcat-javadoc 9.0.62-9.redhat_00005.1.el8jws, jws5-tomcat-selinux 9.0.62-9.redhat_00005.1.el8jws, jws5-tomcat-webapps 9.0.62-9.redhat_00005.1.el8jws, jws5-tomcat-el-3.0-api 9.0.62-9.redhat_00005.1.el8jws, +4 more Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat 9.0.62-9.redhat_00005.1.el9jws, jws5-tomcat-lib 9.0.62-9.redhat_00005.1.el9jws, jws5-tomcat-javadoc 9.0.62-9.redhat_00005.1.el9jws, jws5-tomcat-selinux 9.0.62-9.redhat_00005.1.el9jws, jws5-tomcat-webapps 9.0.62-9.redhat_00005.1.el9jws, jws5-tomcat-el-3.0-api 9.0.62-9.redhat_00005.1.el9jws, +4 more
fixed: vendor fix RHSA-2022:7272
Red Hat Spring Boot 2.7.2.SP1
fixed: vendor fix RHSA-2023:0272
Red Hat Decision Manager 7 tomcat Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-api Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-ecj 4.20.0-1.redhat_00002.1.el7jws, jws5-tomcat-native 1.2.31-10.redhat_10.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-ecj 4.20.0-1.redhat_00002.1.el8jws, jws5-tomcat-native 1.2.31-10.redhat_10.el8jws Red Hat JBoss Web Server 5.7 for RHEL 9 jws5 1-8.el9jws, jws5-runtime 1-8.el9jws, jws5-ecj 4.20.0-1.redhat_00002.1.el9jws, jws5-javapackages-tools 3.4.1-5.15.11.el9jws, jws5-python-javapackages 3.4.1-5.15.11.el9jws, jws5-tomcat-native 1.2.31-10.redhat_10.el9jws, +5 more Red Hat Process Automation 7 tomcat
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
GitHub	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	3.7	AV:L/AC:H/Au:N/C:P/I:P/A:P
OSV	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.tomcat:tomcat	>=10.0.0, <10.0.16 >=9.0.0, <9.0.58 <8.5.75	10.0.16 9.0.58 8.5.75
bitnami	tomcat	>=8.5.55, <8.5.74 >=9.0.35, <9.0.57 >=10.0.1, <10.0.15	8.5.74 9.0.57 10.0.15

Affected products

Apache Software Foundation Apache Tomcat

Classification

Weakness

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

oracle.com /security-alerts/cpuapr2022.html
web, patch, third-party-advisory, advisory
oracle.com /security-alerts/cpujul2022.html
web, patch, third-party-advisory, advisory
debian.org /security/2022/dsa-5265
vendor-advisory, web, third-party-advisory, advisory
lists.apache.org /thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
web, mailing-list, mitigation, vendor-advisory, advisory
security.netapp.com /advisory/ntap-20220217-0010/
third-party-advisory, advisory
lists.debian.org /debian-lts-announce/2022/10/msg00029.html
mailing-list, web, third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2022-23181
advisory, web
github.com /apache/tomcat
package
security.netapp.com /advisory/ntap-20220217-0010
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary