CVE-2022-23181 - Local Privilege Escalation

Severity: Low2022-10-13

Security Advisories


The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

The Oxygen products incorporate Apache Tomcat as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

ProductSeverityFixed Release Availability
Oxygen Feedback Enterprise v2.0.2 and olderLow Oxygen Feedback Enterprise 2.1 build 2022041216
Oxygen XML Web Author v24.0.0 and olderLow Oxygen XML Web Author 24.1.0 build 2022030809





Severity: High

CVSS Score: 7.0

The Apache Tomcat third-party library used by Oxygen XML products is an affected version mentioned in CVE-2022-23181 vulnerability description. However, the Oxygen products are not configured to persist sessions using the FileStore. For that reason, we have rated the severity level for our products as low.

Starting with Oxygen Feedback v2.1 Apache Tomcat library was updated to v9.0.58 which fixes this vulnerability.

Starting with Oxygen XML Web Author v24.1.0 Apache Tomcat library was updated to v9.0.59 which fixes this vulnerability.

List of Security Advisories