CVE-2022-23181

HIGH Year: 2022
CVSS v3 Score
7.0
High
CVSS v2 Score
3.7
Low
Weakness Type
CWE-367
View all →

Vulnerability Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Related Vulnerabilities

CVE-2019-10486

HIGH
CVSS:7.0(High)

Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound access in Snapdragon Auto, Snapdragon Consumer Electronics Connectivit...

CWE-3672019

CVE-2019-14119

HIGH
CVSS:7.0(High)

u'While processing SMCInvoke asynchronous message header, message count is modified leading to a TOCTOU race condition and lead to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon...

CWE-3672019

CVE-2019-15316

HIGH
CVSS:7.0(High)

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to lev...

CWE-3672019

CVE-2020-0204

HIGH
CVSS:7.0(High)

In InstallPackage of package.cpp, there is a possible bypass of a signature check due to a Time of Check/Time of Use condition. This could lead to local escalation of privilege by allowing a bypass of...

CWE-3672020

CVE-2020-0238

HIGH
CVSS:7.0(High)

In updatePreferenceIntents of AccountTypePreferenceLoader, there is a possible confused deputy attack due to a race condition. This could lead to local escalation of privilege and launching privileged...

CWE-3672020

CVE-2020-11233

HIGH
CVSS:7.0(High)

Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdragon Auto, Snapdragon Connectivity, Snapdrag...

CWE-3672020