CVE-2022-23181: Apache Tomcat

High severity, CVSS 7.0. EPSS: 0.7% chance of exploitation in the next 30 days.

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Affected products

• Apache Tomcat: from 8.5.55, up to and including 8.5.73; from 9.0.35, up to and including 9.0.56; from 10.0.1, up to and including 10.0.14; version 10.0.0 only; version 10.1.0 only
• Debian Debian Linux: version 10.0 only; version 11.0 only
• Oracle Agile Engineering Data Management: version 6.2.1.0 only
• Oracle Communications Cloud Native Core Policy: version 1.15.0 only
• Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
• Oracle Managed File Transfer: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle MySQL Enterprise Monitor: up to and including 8.0.29

Published 2022-01-27. Last modified 2026-06-17.