Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.
5.5CVSS
5.2AI Score
0.0004EPSS
Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.
5.5CVSS
5.2AI Score
0.0004EPSS
Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by amalicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX passwor...
7.8CVSS
7.7AI Score
0.0004EPSS