CVE-2022-45935

2023-01-0610:15:10

Google

osv.dev

apache james

temporary files

insecure permissions

local attacker

user data

smtp stack

imap append

version 3.7.2

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit.

Vulnerable components includes the SMTP stack and IMAP APPEND command.

This issue affects Apache James server version 3.7.2 and prior versions.

CPENameOperatorVersion
james-projecteqjames-project-3.7.0
james-projecteqjames-project-3.0-beta5
james-projecteqjames-project-3.0.0-beta5
james-projecteqjames-project-3.0.0-RC1
james-projecteqjames-project-3.3.0
james-projecteqjames-project-3.0.0
james-projecteqcassandra_migration_v1_to_v2
james-projecteqpre-3.1.0
james-projecteqjames-project-3.7.1
james-projecteqjames-project-3.7.2

Name	Operator	Version
james-project	eq	james-project-3.7.0
james-project	eq	james-project-3.0-beta5
james-project	eq	james-project-3.0.0-beta5
james-project	eq	james-project-3.0.0-RC1
james-project	eq	james-project-3.3.0
james-project	eq	james-project-3.0.0
james-project	eq	cassandra_migration_v1_to_v2
james-project	eq	pre-3.1.0
james-project	eq	james-project-3.7.1
james-project	eq	james-project-3.7.2