BIT-tomcat-2022-23181

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/tomcat/BIT-tomcat-2022-23181.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-tomcat-2022-23181
Aliases
Published
2024-03-06T11:09:36.902Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

References

Affected packages

Bitnami / tomcat

Package

Name
tomcat
Purl
pkg:bitnami/tomcat

Severity

  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
8.5.55
Fixed
8.5.73
Introduced
9.0.35
Fixed
9.0.56
Introduced
10.0.1
Fixed
10.0.14
Type
SEMVER
Events
Introduced
10.0.0-milestone10
Last affected
10.0.0-milestone10
Introduced
10.0.0-milestone5
Last affected
10.0.0-milestone5
Introduced
10.0.0-milestone6
Last affected
10.0.0-milestone6
Introduced
10.0.0-milestone7
Last affected
10.0.0-milestone7
Introduced
10.0.0-milestone8
Last affected
10.0.0-milestone8
Introduced
10.0.0-milestone9
Last affected
10.0.0-milestone9
Introduced
10.1.0-milestone1
Last affected
10.1.0-milestone1
Introduced
10.1.0-milestone2
Last affected
10.1.0-milestone2
Introduced
10.1.0-milestone3
Last affected
10.1.0-milestone3
Introduced
10.1.0-milestone4
Last affected
10.1.0-milestone4
Introduced
10.1.0-milestone5
Last affected
10.1.0-milestone5
Introduced
10.1.0-milestone6
Last affected
10.1.0-milestone6
Introduced
10.1.0-milestone7
Last affected
10.1.0-milestone7
Introduced
10.1.0-milestone8
Last affected
10.1.0-milestone8