CVE-2022-45787

Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

5.5 MediumFix available

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions.

We recommend users to upgrade to MIME4j version 0.8.9 or later.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.28%Down 0.6 points since Jan 7, 2023

What each source reports

NVD Score used 5.5

We recommend users to upgrade to MIME4j version 0.8.9 or later.

Record: CVE-2022-45787
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-312
Updated: 2026-11-02

CVE List 5.5

Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

We recommend users to upgrade to MIME4j version 0.8.9 or later.

Record: CVE-2022-45787
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-312, CWE-312
Updated: 2026-11-02

EUVDEUVD-2023-0529 5.5

We recommend users to upgrade to MIME4j version 0.8.9 or later.

Record: EUVD-2023-0529
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q84x-3476-8ff2 5.5

Apache James MIME4J vulnerable to information disclosure to local users

Record: GHSA-q84x-3476-8ff2
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-312
Updated: 2026-11-02

OSVGHSA-q84x-3476-8ff2 5.5

Apache James MIME4J vulnerable to information disclosure to local users

Record: GHSA-q84x-3476-8ff2
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-312
Updated: 2026-11-02

OSVOESA-2025-2296 5.5

apache-mime4j security update

Java stream based MIME message parser.

Security Fix(es):

We recommend users to upgrade to MIME4j version 0.8.9 or later. (CVE-2022-45787)

Record: OESA-2025-2296
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 11 moreShow less

OSVOESA-2025-2343 5.5

apache-mime4j security update

Java stream based MIME message parser.

Security Fix(es):

A vulnerability was found in Apache James MIME4J up to 0.8.8. It has been rated as problematic.Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Impacted is confidentiality.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2022-45787)

Record: OESA-2025-2343
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2025-2344 5.5

apache-mime4j security update

Java stream based MIME message parser.

Security Fix(es):

Record: OESA-2025-2344
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2025-2345 5.5

apache-mime4j security update

Java stream based MIME message parser.

Security Fix(es):

Record: OESA-2025-2345
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2025-2346 5.5

apache-mime4j security update

Java stream based MIME message parser.

Security Fix(es):

Record: OESA-2025-2346
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2025-2347 5.5

apache-mime4j security update

Java stream based MIME message parser.

Security Fix(es):

Record: OESA-2025-2347
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2023:1512 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update

Record: RHSA-2023:1512
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:1513 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update

Record: RHSA-2023:1513
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:1514 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update

Record: RHSA-2023:1514
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:2705 7.5

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7

Record: RHSA-2023:2705
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2023:2706 7.5

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 8

Record: RHSA-2023:2706
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2023:2707 7.5

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 9

Record: RHSA-2023:2707
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.james:apache-mime4j-storage` Maven	before 0.8.9	0.8.9
`org.apache.james:apache-mime4j-storage` Maven	before 0.8.9, plus listed versions 0.70.7.10.7.20.8.00.8.1 Show 7 moreShow less 0.8.20.8.30.8.40.8.50.8.60.8.70.8.8	0.8.9
`apache-mime4j` openEuler:20.03-LTS-SP4	before 0.8.1-3.oe2003sp4	0.8.1-3.oe2003sp4
`apache-mime4j` openEuler:24.03-LTS-SP2	before 0.8.7-5.oe2403sp2	0.8.7-5.oe2403sp2
`apache-mime4j` openEuler:22.03-LTS-SP3	before 0.8.3-3.oe2203sp3	0.8.3-3.oe2203sp3
`apache-mime4j` openEuler:22.03-LTS-SP4	before 0.8.3-3.oe2203sp4	0.8.3-3.oe2203sp4
`apache-mime4j` openEuler:24.03-LTS	before 0.8.7-5.oe2403	0.8.7-5.oe2403
`apache-mime4j` openEuler:24.03-LTS-SP1	before 0.8.7-5.oe2403sp1	0.8.7-5.oe2403sp1
`eap7-snakeyaml` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.33.0-2.SP1_redhat_00001.1.el7eap	0:1.33.0-2.SP1_redhat_00001.1.el7eap
`eap7-undertow` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:2.2.23-1.SP2_redhat_00001.1.el7eap	0:2.2.23-1.SP2_redhat_00001.1.el7eap

Show 290 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45787 is a medium vulnerability (CVSS 5.5) in Apache James, published January 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in org.apache.james:apache-mime4j-storage 0.8.9.

References

Show 91 moreShow less

This page doesn't list everything

Left out here: 37 package rows. The JSON record has them.

Affected packages
Package	Affected	Fixed
`eap7-undertow-jastow` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:2.0.14-1.Final_redhat_00001.1.el7eap	0:2.0.14-1.Final_redhat_00001.1.el7eap
`eap7-activemq-artemis-native` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 1:1.0.2-3.redhat_00004.1.el7eap	1:1.0.2-3.redhat_00004.1.el7eap
`eap7-apache-mime4j` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:0.8.9-1.redhat_00001.1.el7eap	0:0.8.9-1.redhat_00001.1.el7eap
`eap7-artemis-native` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 1:1.0.2-4.redhat_00004.1.el7eap	1:1.0.2-4.redhat_00004.1.el7eap
`eap7-artemis-native-debuginfo` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 1:1.0.2-4.redhat_00004.1.el7eap	1:1.0.2-4.redhat_00004.1.el7eap
`eap7-artemis-native-wildfly` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 1:1.0.2-4.redhat_00004.1.el7eap	1:1.0.2-4.redhat_00004.1.el7eap
`eap7-artemis-wildfly-integration` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.0.7-1.redhat_00001.1.el7eap	0:1.0.7-1.redhat_00001.1.el7eap
`eap7-infinispan` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-cachestore-jdbc` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-cachestore-remote` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-client-hotrod` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-commons` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-component-annotations` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-core` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-hibernate-cache-commons` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-hibernate-cache-spi` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-infinispan-hibernate-cache-v53` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:11.0.17-1.Final_redhat_00001.1.el7eap	0:11.0.17-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar-common-api` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar-common-impl` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar-common-spi` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar-core-api` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar-core-impl` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar-deployers-common` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar-jdbc` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-ironjacamar-validator` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.5.11-1.Final_redhat_00001.1.el7eap	0:1.5.11-1.Final_redhat_00001.1.el7eap
`eap7-jboss-ejb-client` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:4.0.50-1.Final_redhat_00001.1.el7eap	0:4.0.50-1.Final_redhat_00001.1.el7eap
`eap7-jboss-el-api_3.0_spec` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:2.0.1-1.Final_redhat_00001.1.el7eap	0:2.0.1-1.Final_redhat_00001.1.el7eap
`eap7-jboss-metadata` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:13.4.0-1.Final_redhat_00001.1.el7eap	0:13.4.0-1.Final_redhat_00001.1.el7eap
`eap7-jboss-metadata-appclient` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:13.4.0-1.Final_redhat_00001.1.el7eap	0:13.4.0-1.Final_redhat_00001.1.el7eap
`eap7-jboss-metadata-common` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:13.4.0-1.Final_redhat_00001.1.el7eap	0:13.4.0-1.Final_redhat_00001.1.el7eap
`eap7-jboss-metadata-ear` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:13.4.0-1.Final_redhat_00001.1.el7eap	0:13.4.0-1.Final_redhat_00001.1.el7eap
`eap7-jboss-metadata-ejb` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:13.4.0-1.Final_redhat_00001.1.el7eap	0:13.4.0-1.Final_redhat_00001.1.el7eap
`eap7-jboss-metadata-web` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:13.4.0-1.Final_redhat_00001.1.el7eap	0:13.4.0-1.Final_redhat_00001.1.el7eap
`eap7-jboss-server-migration` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.10.0-26.Final_redhat_00025.1.el7eap	0:1.10.0-26.Final_redhat_00025.1.el7eap
`eap7-jboss-server-migration-cli` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.10.0-26.Final_redhat_00025.1.el7eap	0:1.10.0-26.Final_redhat_00025.1.el7eap
`eap7-jboss-server-migration-core` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.10.0-26.Final_redhat_00025.1.el7eap	0:1.10.0-26.Final_redhat_00025.1.el7eap
`eap7-jbossws-cxf` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:5.4.8-1.Final_redhat_00001.1.el7eap	0:5.4.8-1.Final_redhat_00001.1.el7eap
`eap7-jbossws-spi` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:3.4.0-2.Final_redhat_00001.1.el7eap	0:3.4.0-2.Final_redhat_00001.1.el7eap
`eap7-netty` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:4.1.86-1.Final_redhat_00001.1.el7eap	0:4.1.86-1.Final_redhat_00001.1.el7eap