CVE: 2022-23181 found in tomcat-embed-core - Version: 9.0.36 [JAVA]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	tomcat-embed-core
Description	Core Tomcat implementation
Language	JAVA
Vulnerability	Time Of Check To Time Of Use (TOCTOU)
Vulnerability description	tomcat-catalina is vulnerable to time of check to time of use. The vulnerability exists in file function of FileStore.java which allows an attacker to perform unauthenticated actions causing a race condition.
CVE	2022-23181
CVSS score	3.7
Vulnerability present in version/s	9.0.0.M1-9.0.56
Found library version/s	9.0.36
Vulnerability fixed in version	9.0.58
Library latest version	11.0.9
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1334?version=9.0.36
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/33938
• Patch: apache/tomcat@1385c62