Description

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

Remediation

References

https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d

Related Vulnerabilities

CVE-2022-45935 Vulnerability in maven package org.apache.james:apache-mailet-standard

CVE-2023-42795 Vulnerability in maven package org.apache.tomcat:tomcat

CVE-2019-1003085 Vulnerability in maven package org.jenkins-ci.plugins:zephyr-enterprise-test-management

CVE-2021-21661 Vulnerability in maven package org.jenkins-ci.plugins:kubernetes-cli

CVE-2020-1727 Vulnerability in maven package org.keycloak:keycloak-services

Severity

Medium

Classification

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Vendor Advisory NVD-CWE-noinfo