Medium severity · published Jan 6, 2023
CVE-2022-45935
Apache James server: Temporary File Information Disclosure
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit.
Vulnerable components includes the SMTP stack and IMAP APPEND command.
This issue affects Apache James server version 3.7.2 and prior versions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AJ
Apache James server · Apache Software Foundation
through 3.7.2 · source: vendor
JA
James · Apache
through 3.7.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45935
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45935
Mailing List
https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d
More from Apache James server
9.8
CVE-2023-51518
Apache James server: Privilege escalation via JMX pre-authentication deserialisation
7.8
CVE-2023-26269
Apache James server: Privilege escalation through unauthenticated JMX
7.5
CVE-2024-37358
Apache James: denial of service through the use of IMAP literals
7.5
CVE-2024-45626
Apache James: denial of service through JMAP HTML to text conversion
7.1
CVE-2023-51747
SMTP smuggling in Apache James