VYPR
← All advisories
High severityNVD Advisory· Published Jan 27, 2022· Updated Aug 3, 2024

Local privilege escalation with FileStore

CVE-2022-23181

Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A time-of-check time-of-use vulnerability in Apache Tomcat's FileStore session persistence allows a local attacker to escalate privileges to the Tomcat user.

Vulnerability

The fix for CVE-2020-9484 introduced a time-of-check, time-of-use (TOCTOU) vulnerability in Apache Tomcat's session persistence mechanism when using the FileStore. Affected versions include 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56, and 8.5.55 to 8.5.73. The issue is only exploitable when Tomcat is configured to persist sessions using the FileStore [1].

Exploitation

A local attacker with write access to the session storage directory can exploit the race window between the check and use of session files. The attacker must be able to create or modify files in the session store while Tomcat is processing a session. No authentication is required beyond local access to the file system [1].

Impact

Successful exploitation allows the attacker to perform actions with the privileges of the user that the Tomcat process is running as. This can lead to unauthorized access to sensitive data, modification of server configuration, or further compromise of the host system [1].

Mitigation

As of the publication date, no fixed version has been announced in the available references. The recommended workaround is to avoid using the FileStore for session persistence; instead, use the default in-memory store or a database-backed session store. If FileStore is necessary, restrict write access to the session storage directory to only the Tomcat user [1].

References
  1. NVD - CVE-2022-23181

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcatMaven
>= 10.0.0, < 10.0.1610.0.16
org.apache.tomcat:tomcatMaven
>= 9.0.0, < 9.0.589.0.58
org.apache.tomcat:tomcatMaven
< 8.5.758.5.75

Affected products

44

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.