CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

• CWE-367
• CWE-367

• https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9Mailing List, Mitigation, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00029.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220217-0010/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5265Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9Mailing List, Mitigation, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00029.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220217-0010/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5265Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

Jan 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23173this vulnerability affect user that even not allowed to acce…6.3
• CVE-2022-23176WatchGuard Firebox and XTM appliances allow a remote attacke…8.8
• CVE-2022-23178An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159…9.8
• CVE-2022-23179The Contact Form & Lead Form Elementor Builder WordPress plu…4.8
• CVE-2022-2318There are use-after-free vulnerabilities caused by timer han…5.5
• CVE-2022-23180The Contact Form & Lead Form Elementor Builder WordPress plu…4.3
• CVE-2022-23182Improper access control in the Intel(R) Data Center Manager …8.8
• CVE-2022-23183Missing authorization vulnerability in Advanced Custom Field…6.5
• CVE-2022-23184In affected Octopus Server versions when the server HTTP and…6.1
• CVE-2022-23186Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (…7.8
• CVE-2022-23187Adobe Illustrator version 26.0.3 (and earlier) is affected b…7.8
• CVE-2022-23188Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (…7.8