~ / search / GHSA-v6vp-62vc-84qw

GHSA-v6vp-62vc-84qw

Apache James server allows an attacker with local access to access private user data in transit

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-45935

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.james:james-server <= 3.7.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

References

External links from the advisory. They lead to third-party sites.