MEDIUM5.5

GHSA-v6vp-62vc-84qw

Apache James server allows an attacker with local access to access private user data in transit

Details

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.james:james-server

Introduced in: 0

No fixed version published yet for org.apache.james:james-server (maven). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-45935[ADVISORY]
https://github.com/apache/james-project/commit/b5580d13d6c74ecbf647127eff1a3ac1086f5493[WEB]
https://github.com/apache/james-project[PACKAGE]
https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d[WEB]