PT-2023-14754 · Apache · Mime4J

Jonathan Leitschuh · Published 2023-01-06 · Updated 2025-09-26 · CVE-2022-45787

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache James MIME4J versions prior to 0.8.9

Description Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users.

Recommendations For Apache James MIME4J versions prior to 0.8.9, upgrade to MIME4j version 0.8.9 or later.

Fix

Information Disclosure

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-312

Related Identifiers

CVE-2022-45787

GHSA-Q84X-3476-8FF2

OESA-2025-2296

OESA-2025-2343

OESA-2025-2344

OESA-2025-2345

OESA-2025-2346

OESA-2025-2347

RHSA-2023:1512

RHSA-2023:1513

RHSA-2023:1514

RHSA-2023:2705

RHSA-2023:2706

RHSA-2023:2707

Affected Products

Mime4J

References · 23

• https://osv.dev/vulnerability/OESA-2025-2296 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2344 · Vendor Advisory
• https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2347 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q84x-3476-8ff2 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2345 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2343 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45787 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45787 · Vendor Advisory
• https://github.com/apache/james-mime4j/commit/021eb79ba312fe5a7f99fa867ee5350aa5533069 · Note
• https://github.com/apache/james-mime4j/blob/master/CHANGELOG.md#089---2022-12-30 · Note
• https://github.com/apache/james-mime4j · Note
• https://issues.apache.org/jira/browse/MIME4J-322 · Note
• https://t.me/cvenotify/42076 · Telegram Post