CVE-2022-45935

Published Jan 6, 2023

Last updated a year ago

CVSS medium 5.5

Overview

Description: Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.
Source: security@apache.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

security@apache.org: CWE-668
nvd@nist.gov: CWE-668

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F0C5B5CE-7844-48F0-A791-3823B74B4F1A",
            "versionEndIncluding": "3.7.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References