PT-2023-14802 · Apache · Apache James Server

Benoit Tellier · Publicado 2023-01-06 · Atualizado 2025-04-10 · CVE-2022-45935

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache James server versions 3.7.2 and prior versions

Description The issue allows an attacker with local access to access private user data in transit due to the usage of temporary files with insecure permissions by the Apache James server. Vulnerable components include the SMTP stack and IMAP APPEND command.

Recommendations For Apache James server versions 3.7.2 and prior versions, consider updating to a version that fixes the issue with temporary file permissions as a permanent solution. As a temporary workaround, restrict access to the SMTP stack and IMAP APPEND command to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Information Disclosure

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-319

CWE-200

CWE-668

Identificadores relacionados

CVE-2022-45935

GHSA-V6VP-62VC-84QW

Produtos afetados

Apache James Server

Referências · 9

• https://github.com/apache/james-project · Nota
• https://github.com/apache/james-project/commit/b5580d13d6c74ecbf647127eff1a3ac1086f5493 · Nota
• https://t.me/cibsecurity/56037 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45935 · Nota de Segurança
• https://t.me/cvenotify/42075 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-v6vp-62vc-84qw · Aviso do Fabricante
• https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d · Aviso do Fabricante
• https://t.me/cvenotify/118610 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-45935 · Aviso do Fabricante