CX: CVE-2022-23181 in Maven-org.apache.tomcat.embed:tomcat-embed-core and 9.0.55 @ hello-world-java.master

[DhavalPatelPersistent]

Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

HIGH Vulnerable Package issue exists @ org.apache.tomcat.embed:tomcat-embed-core in branch master

Vulnerability ID: CVE-2022-23181

Package Name: org.apache.tomcat.embed:tomcat-embed-core

Severity: HIGH

CVSS Score: 7.0

Publish Date: 2022-01-27T13:15:00

Current Package Version: 9.0.55

Remediation Upgrade Recommendation:

Link To SCA

Reference – NVD link

[DhavalPatelPersistent]

Issue still exists.

[DhavalPatelPersistent]

Issue still exists.

[DhavalPatelPersistent]

Issue still exists.