CVE-2020-8022: Incorrect Default Permissions in Apache Tomcat
Summary
GHSA-gc58-v8h3-x2gr: Incorrect Default Permissions in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
< 8.0.53
>= 9.0.0, < 9.0.35
Fixed in 8.0.53 or 9.0.35, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. However, a vulnerability has been discovered in the packaging of Tomcat, which affects various versions of SUSE Enterprise Storage, SUSE Linux Enterprise Server, SUSE Linux Enterprise Server for SAP, and SUSE OpenStack Cloud. This vulnerability allows local attackers to escalate privileges from the 'tomcat' group to root, potentially leading to unauthorized access and control of the affected system.
Vulnerability Detail
The vulnerability arises from incorrect default permissions in the packaging of Tomcat. Specifically, certain versions of Tomcat on the affected SUSE platforms have insecure default permissions that allow local attackers who belong to the 'tomcat' group to escalate their privileges to root. This means that an attacker with limited access to the system, such as a user in the 'tomcat' group, can exploit this vulnerability to gain full control over the system. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary commands with root privileges, potentially compromising the confidentiality, integrity, and availability of the affected system.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.0.538.0.53 -
>= 9.0.0, < 9.0.359.0.35
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general security best practice, it is recommended to follow the principle of least privilege and restrict access to sensitive systems and resources. Additionally, implementing strong access controls, regularly monitoring system logs for suspicious activities, and keeping the system and software up to date with the latest security patches can help mitigate the risk of exploitation.
Conclusion
The vulnerability in Apache Tomcat on various SUSE platforms can allow local attackers to escalate privileges and gain unauthorized access to the affected system. It is crucial to update the affected versions of Tomcat to the patched versions as soon as possible. Following security best practices, such as implementing strong access controls and regularly monitoring system logs, can further enhance the security posture. For more information and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
The vulnerability allows local attackers to escalate privileges from the 'tomcat' group to root, potentially gaining full control over the affected system.
The vulnerability affects certain versions of Tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server, SUSE Linux Enterprise Server for SAP, and SUSE OpenStack Cloud. Please refer to the advisory for the specific affected versions.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is important to apply the necessary security updates to mitigate the risk.
No, this vulnerability requires local access to the system. Remote exploitation is not possible.
While patching is the recommended solution, implementing strong access controls, monitoring system logs, and keeping the system up to date with the latest security patches can help mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
