Description

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

Remediation

References

https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d

Related Vulnerabilities

CVE-2023-27987 Vulnerability in maven package org.apache.linkis:linkis-cs-client

CVE-2020-2124 Vulnerability in maven package com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter

CVE-2022-34802 Vulnerability in maven package org.jenkins-ci.plugins:rocketchatnotifier

CVE-2023-40349 Vulnerability in maven package org.jenkins-ci.plugins:gogs-webhook

CVE-2020-6460 Vulnerability in maven package org.webjars.npm:electron

Severity

Medium

Classification

CWE-668 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Vendor Advisory