CVE-2022-23181 - Local Privilege Escalation
Severity: Low2022-10-13
Abstract
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
The Oxygen products incorporate Apache Tomcat as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.
Affected Products/Versions
| Product | Severity | Fixed Release Availability |
| Oxygen Feedback Enterprise v2.0.2 and older | Low | Oxygen Feedback Enterprise 2.1 build 2022041216 |
| Oxygen XML Web Author v24.0.0 and older | Low | Oxygen XML Web Author 24.1.0 build 2022030809 |
Detail
CVE-2022-23181
Severity: High
CVSS Score: 7.0
The Apache Tomcat third-party library used by Oxygen XML products is an affected version mentioned in CVE-2022-23181 vulnerability description. However, the Oxygen products are not configured to persist sessions using the FileStore. For that reason, we have rated the severity level for our products as low.
Starting with Oxygen Feedback v2.1 Apache Tomcat library was updated to v9.0.58 which fixes this vulnerability.
Starting with Oxygen XML Web Author v24.1.0 Apache Tomcat library was updated to v9.0.59 which fixes this vulnerability.
