Skip to content
Fencer Vulns
medium 5.5

CVE-2022-45787 json

Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

published 2023-01-06 3 y ago modified 2026-06-17 4 mo ago also GHSA-q84x-3476-8ff2 , EUVD-2023-0529

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions.

We recommend users to upgrade to MIME4j version 0.8.9 or later.

Patch / fix

  • maven org.apache.james:apache-mime4j-storage 0.8.9
  • apache james 0.8.9
  • eap7-netty jboss enterprise application platform 7.4 4.1.86-1.Final_redhat_00001.1.el9eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.10-6.GA_redhat_00002.1.el9eap
  • eap7-resteasy jboss enterprise application platform 7.4 3.15.5-1.Final_redhat_00001.1.el9eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.23-1.SP2_redhat_00001.1.el9eap
  • eap7-snakeyaml jboss enterprise application platform 7.4 1.33.0-2.SP1_redhat_00001.1.el9eap
  • eap7-infinispan jboss enterprise application platform 7.4 11.0.17-1.Final_redhat_00001.1.el9eap
  • eap7-ironjacamar jboss enterprise application platform 7.4 1.5.11-1.Final_redhat_00001.1.el9eap
  • eap7-jbossws-cxf jboss enterprise application platform 7.4 5.4.8-1.Final_redhat_00001.1.el9eap

red hat advisories RHSA-2023:1514RHSA-2023:1513RHSA-2023:1512RHSA-2023:2707RHSA-2023:2706RHSA-2023:2705

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-45787 updated cvss 5.5

apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

  • Red Hat build of Apache Camel for Spring Boot 3 apache-james-mime4j apache-james-mime4j
    affected: no fix available “Fix deferred”
  • Red Hat Decision Manager 7 apache-james-mime4j apache-james-mime4j Red Hat Fuse 7 apache-james-mime4j apache-james-mime4j
    affected: no fix planned “Out of support scope”
  • Red Hat Integration Camel K 1 apache-james-mime4j apache-james-mime4j
    affected: no fix available “Fix deferred”
  • Red Hat Integration Camel Quarkus 1 apache-james-mime4j apache-james-mime4j
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 7 apache-james-mime4j apache-james-mime4j Red Hat JBoss Data Virtualization 6 apache-james-mime4j apache-james-mime4j Red Hat JBoss Enterprise Application Platform 6 apache-james-mime4j apache-james-mime4j
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack apache-james-mime4j apache-james-mime4j
    affected: no fix available
  • Red Hat JBoss Fuse 6 apache-james-mime4j apache-james-mime4j Red Hat JBoss Fuse Service Works 6 apache-james-mime4j apache-james-mime4j Red Hat Process Automation 7 apache-james-mime4j apache-james-mime4j Red Hat Satellite 6 apache-james-mime4j
    affected: no fix planned “Out of support scope”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-22
    fixed: vendor fix RHSA-2023:2710
show 11 more
  • Red Hat build of Quarkus 2.13.8.Final apache-mime4j-storage 0.8.9.redhat-00001
    fixed: vendor fix RHSA-2023:3809
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el7eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el7eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el7eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el7eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el7eap, +100 more
    fixed: vendor fix RHSA-2023:1512
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el8eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el8eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el8eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el8eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el8eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el8eap, +101 more
    fixed: vendor fix RHSA-2023:1513
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el9eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el9eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el9eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el9eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el9eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el9eap, +100 more
    fixed: vendor fix RHSA-2023:1514
  • Red Hat JBoss Enterprise Application Platform apache-mime4j-core 0.8.9.redhat-00001
    fixed: vendor fix RHSA-2023:1516
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:2713
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:2705
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:2706
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:2707
  • Red Hat RHINT Service Registry 2.4.3 GA
    fixed: vendor fix RHSA-2023:3815
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat Migration Toolkit for Applications 6 org.keycloak-keycloak-parent Red Hat Migration Toolkit for Runtimes org.keycloak-keycloak-parent Red Hat build of Quarkus 2.13.8.Final jna 5.8.0, bson 4.7.2, db2 1.17.3, h2 2.1.214, jansi 1.18, jdom 1.1.3, +872 more Red Hat Data Grid 8 apache-james-mime4j apache-james-mime4j Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1541 more
    +1 more products
    Red Hat OpenShift Application Runtimes apache-james-mime4j apache-james-mime4j
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.james:apache-mime4j-storage
<0.8.9
0.8.9

Affected products

  • Apache Software Foundation Apache James MIME4J

Classification

Weakness
  • CWE-312 Cleartext Storage of Sensitive Information
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.