CVE-2022-23181: Apache Tomcat FileStore Time of Check Time of Use Vulnerability
Summary
CVE-2022-23181: Race condition in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
< 8.5.75
>= 9.0.0, < 9.0.58
>= 10.0.0, < 10.0.16
Fixed in 8.5.75, 9.0.58 or 10.0.16, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-23181 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The FileStore is a component in Tomcat that allows sessions to be persisted on the file system. This vulnerability affects Apache Tomcat versions 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56, and 8.5.55 to 8.5.73 when configured to use the FileStore for session persistence.
Vulnerability Detail
The fix for CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat. This vulnerability allows a local attacker to exploit a race condition and perform actions with the privileges of the user that the Tomcat process is running as. The attacker needs to have local access to the system and the ability to manipulate files in the Tomcat FileStore. This vulnerability is only exploitable when Tomcat is configured to persist sessions using the FileStore.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.5.758.5.75 -
>= 9.0.0, < 9.0.589.0.58 -
>= 10.0.0, < 10.0.1610.0.16
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading immediately is not possible, a workaround is to switch to a different session persistence mechanism that is not affected by this vulnerability. For example, using a database or a different file system-based persistence mechanism can mitigate the risk. However, it is still recommended to upgrade to the fixed versions as soon as possible.
Conclusion
The Apache Tomcat FileStore Time of Check Time of Use vulnerability (CVE-2022-23181) allows a local attacker to exploit a race condition and perform actions with elevated privileges. It is recommended to upgrade to the fixed versions of Apache Tomcat as soon as possible. If immediate upgrade is not possible, switching to a different session persistence mechanism can provide temporary mitigation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
This vulnerability allows a local attacker to perform actions with the privileges of the Tomcat process, potentially leading to unauthorized access, data manipulation, or denial of service.
No, this vulnerability can only be exploited by a local attacker with access to the system and the ability to manipulate files in the Tomcat FileStore.
No, only versions 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56, and 8.5.55 to 8.5.73 are affected when configured to use the FileStore for session persistence.
The CVSS score of this vulnerability is 7.0, indicating a high severity.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
