CVE-2022-45787 Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

What is CVE-2022-45787?

CVE-2022-45787 is a medium-severity vulnerability in Apache James MIME4J, published on 6 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions.

We recommend users to upgrade to MIME4j version 0.8.9 or later.

Weakness: CWE-312

Which versions are affected by CVE-2022-45787?

2 open source packages ship an affected version, including org.apache.james:apache-mime4j-storage. It affects 1 product.

Products include Apache James.

How do I fix CVE-2022-45787?

Upgrade org.apache.james:apache-mime4j-storage to 0.8.9 or later.

Is CVE-2022-45787 being exploited?

There is no known exploitation of CVE-2022-45787 in the wild and no public exploit code.

Other vulnerabilities in Apache James MIME4J

• CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation Critical 9.8
• CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox Critical 9.8
• CVE-2021-40525 Sieve file storage vulnerable to path traversal attacks Critical 9.1
• CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX High 7.8
• CVE-2006-2806 Denial of service in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q84x-3476-8ff2, OESA-2025-2296, OESA-2025-2343, OESA-2025-2344, OESA-2025-2345, OESA-2025-2346 and 1 more.