PT-2023-14754 · Apache · Mime4J

Jonathan Leitschuh · Publicado 2023-01-06 · Atualizado 2025-09-26 · CVE-2022-45787

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache James MIME4J versions prior to 0.8.9

Description Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users.

Recommendations For Apache James MIME4J versions prior to 0.8.9, upgrade to MIME4j version 0.8.9 or later.

Correção

Information Disclosure

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-200

CWE-312

Identificadores relacionados

CVE-2022-45787

GHSA-Q84X-3476-8FF2

OESA-2025-2296

OESA-2025-2343

OESA-2025-2344

OESA-2025-2345

OESA-2025-2346

OESA-2025-2347

RHSA-2023:1512

RHSA-2023:1513

RHSA-2023:1514

RHSA-2023:2705

RHSA-2023:2706

RHSA-2023:2707

Produtos afetados

Mime4J

Referências · 23

• https://github.com/apache/james-mime4j/commit/021eb79ba312fe5a7f99fa867ee5350aa5533069 · Nota
• https://github.com/apache/james-mime4j/blob/master/CHANGELOG.md#089---2022-12-30 · Nota
• https://github.com/apache/james-mime4j · Nota
• https://issues.apache.org/jira/browse/MIME4J-322 · Nota
• https://osv.dev/vulnerability/OESA-2025-2296 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2025-2344 · Aviso do Fabricante
• https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2025-2347 · Aviso do Fabricante
• https://t.me/cvenotify/42076 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-q84x-3476-8ff2 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2344 · Nota
• https://osv.dev/vulnerability/OESA-2025-2345 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2025-2343 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2346 · Nota
• https://osv.dev/vulnerability/OESA-2025-2346 · Aviso do Fabricante