CVE-2022-45787

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions.

We recommend users to upgrade to MIME4j version 0.8.9 or later.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

VendorProductVersions
Apache Software FoundationApache James MIME4J<= 0.8.8

References

Timeline

Published
Jan 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-457889.8A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of seCVE-2022-457899.8A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the cCVE-2022-457909.1The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attackCVE-2022-457927.8Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal CVE-2022-457937.8Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files CVE-2022-457947.5An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and writCVE-2022-457967.2Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 CVE-2022-457977.1An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a ServicCVE-2022-457987.8A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could alCVE-2022-45805.4The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputtiCVE-2022-458015.4Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications thaCVE-2022-458029.8Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users
CVE-2022-45787: Medium severity, CVSS 5.5 | Vulnix