CVE-2022-45935 Apache James server: Temporary File Information Disclosure
Local attackers can access private user data in transit due to insecure permissions on temporary files in the SMTP and IMAP components.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-45935?
CVE-2022-45935 is a medium-severity vulnerability in Apache James server, published on 6 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit.
Vulnerable components includes the SMTP stack and IMAP APPEND command.
This issue affects Apache James server version 3.7.2 and prior versions.
Weakness: CWE-668
Which versions are affected by CVE-2022-45935?
2 open source packages ship an affected version, including org.apache.james:james-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.james:james-server Maven | All versions to 3.7.2 | None |
org.apache.james:james-server Maven | All versions to 3.7.2 | None |
Products include Apache James.
How do I fix CVE-2022-45935?
No fix has been published for CVE-2022-45935 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-45935 being exploited?
There is no known exploitation of CVE-2022-45935 in the wild and no public exploit code.
Other vulnerabilities in Apache James server
- CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation
- CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox
- CVE-2021-40525 Sieve file storage vulnerable to path traversal attacks
- CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX
- CVE-2006-2806 Denial of service in n/a
Sources
Also known as GHSA-v6vp-62vc-84qw.