PT-2023-14802 · Apache · Apache James Server

Benoit Tellier · Published 2023-01-06 · Updated 2025-04-10 · CVE-2022-45935

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache James server versions 3.7.2 and prior versions

Description The issue allows an attacker with local access to access private user data in transit due to the usage of temporary files with insecure permissions by the Apache James server. Vulnerable components include the SMTP stack and IMAP APPEND command.

Recommendations For Apache James server versions 3.7.2 and prior versions, consider updating to a version that fixes the issue with temporary file permissions as a permanent solution. As a temporary workaround, restrict access to the SMTP stack and IMAP APPEND command to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-319

CWE-200

CWE-668

Related Identifiers

CVE-2022-45935

GHSA-V6VP-62VC-84QW

Affected Products

Apache James Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-45935 · Security Note
• https://osv.dev/vulnerability/GHSA-v6vp-62vc-84qw · Vendor Advisory
• https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45935 · Vendor Advisory
• https://github.com/apache/james-project · Note
• https://github.com/apache/james-project/commit/b5580d13d6c74ecbf647127eff1a3ac1086f5493 · Note
• https://t.me/cibsecurity/56037 · Telegram Post
• https://t.me/cvenotify/42075 · Telegram Post
• https://t.me/cvenotify/118610 · Telegram Post