CVE-2022-45935

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-45935
Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d Mailing List Vendor Advisory
https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:29

Type Values Removed Values Added
Summary
  • (es) El uso de archivos temporales con permisos inseguros por parte del servidor Apache James permite a un atacante con acceso local acceder a datos privados del usuario en tránsito. Los componentes vulnerables incluyen la pila SMTP y el comando IMAP APPEND. Este problema afecta al servidor Apache James versión 3.7.2 y versiones anteriores.
References () https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d - Mailing List, Vendor Advisory () https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d - Mailing List, Vendor Advisory

12 Jul 2023, 11:15

Type Values Removed Values Added
Summary Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions. Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

07 Jul 2023, 19:03

Type Values Removed Values Added
New CVE
Information

Published : 2023-01-06 10:15

Updated : 2024-11-21 07:29

NVD link : CVE-2022-45935

Mitre link : CVE-2022-45935

CVE.ORG link : CVE-2022-45935

JSON object : View

Products Affected

apache

  • james
CWE
CWE-668

Exposure of Resource to Wrong Sphere