Local privilege escalation with FileStore (Apache Software Foundation Apache Tomcat)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.69 % · percentile 53 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Weaknesses (CWE)
- CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition
References
- https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220217-0010/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
- https://www.debian.org/security/2022/dsa-5265
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.7 | AV:L/AC:H/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-9f3j-pm6f-9fm5 — Race condition in Apache Tomcat
European references
- ENISA EUVD · EUVD-2022-0937
- GCVE · GCVE-0-2022-23181
CERT-FR advisories
- CERTFR-2024-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-345 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2022-AVI-082 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 8.5.55 ≤ 8.5.73cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 9.0.35 ≤ 9.0.56cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 10.0.1 ≤ 10.0.14cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*≤ 8.0.29cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat | affected Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8 ; affected Apache Tomcat 10.0 10.0.0-M5 to 10.0.14 ; affected Apache Tomcat 9 9.0.35 to 9.0.56 ; affected Apache Tomcat 8 8.5.55 to 8.5.73 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |