CVE-2022-45787: Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-06 · updated 2026-06-17
Weakness: CWE-312

Description

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.

Affected products

Apache Software Foundation Apache James: before 0.8.9 — fixed in 0.8.9

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache James 0.8.9. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj
https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj

Get alerted when CVE-2022-45787 or the next vulnerability affects your stack