GitHub Advisoryadvisory · Maven

GHSA-v6vp-62vc-84qw Apache James server allows an attacker with local access to access private user data in transit

MEDIUM Published 2023-01-06 Modified 2023-01-12 Official page ↗
Aliases
CVE-2022-45935
Ecosystem
Maven
Packages
org.apache.james:james-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-319, CWE-668
Reviewed
2023-01-09

Affected packages

• Maven org.apache.james:james-server: <= 3.7.2 (no fix yet)

Description

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

Related

Alias · CVE (1)

  • CVE-2022-45935 Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user… vulnerability

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References