CVE:CVE-2022-23181
CNNVD:CNNVD-202201-2423
Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat 存在权限许可和访问控制问题漏洞，攻击者可以通过 FileStore Sessions 绕过 Apache Tomcat 的限制，以提升他的权限。
solution:Upgrade apache tomcat to a higher version than 8.5.73,9.0.56,10.0.14,10.0.0:milestone10,10.0.0:milestone5,10.0.0:milestone6,10.0.0:milestone7,10.0.0:milestone8,10.0.0:milestone9,10.1.0:milestone1,10.1.0:milestone2,10.1.0:milestone3,10.1.0:milestone4,10.1.0:milestone5,10.1.0:milestone6,10.1.0:milestone7,10.1.0:milestone8,and avoid the version [8.5.55,8.5.73],[9.0.35,9.0.56],[10.0.1,10.0.14],10.0.0:milestone10,10.0.0:milestone5,10.0.0:milestone6,10.0.0:milestone7,10.0.0:milestone8,10.0.0:milestone9,10.1.0:milestone1,10.1.0:milestone2,10.1.0:milestone3,10.1.0:milestone4,10.1.0:milestone5,10.1.0:milestone6,10.1.0:milestone7,10.1.0:milestone8; Upgrade oracle agile_engineering_data_management to a higher version than 6.2.1.0,and avoid the version 6.2.1.0; Upgrade oracle communications_cloud_native_core_policy to a higher version than 1.15.0,and avoid the version 1.15.0; Upgrade oracle financial_services_crime_and_compliance_management_studio to a higher version than 8.0.8.2.0,8.0.8.3.0,and avoid the version 8.0.8.2.0,8.0.8.3.0; Upgrade oracle managed_file_transfer to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle mysql_enterprise_monitor to a higher version than 8.0.29,and avoid the version (,8.0.29]; Upgrade debian debian_linux to a higher version than 10.0,11.0,and avoid the version 10.0,11.0