CVE-2022-45787 Security Details

CVE ID

CVE-2022-45787

CWE

CWE-312

CVE Description

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.

Published

Jan 9, 2023

CVSS Score & Severity

5.5Medium

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

0.009%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/james/mime4j/storage/TempFileStorageProvider.createStorageOutputStream()Lorg/apache/james/mime4j/storage/StorageOutputStream;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · PR #82PROJECT

Apache · AnnouncementPROJECT