CVE-2023-34204
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
CVE-2023-34204 affects imapsync versions up to 2.229, which uses predictable paths in the /tmp and /var/tmp directories. These directories are typically world-writable, allowing an attacker to modify imapsync's cache and overwrite user files.
Risk Assessment
The risk to the organization involves the potential for an attacker to modify user data, leading to data integrity loss and possible security breaches.
Recommendation
It is recommended to update imapsync to the latest version and restrict access to the /tmp and /var/tmp directories to minimize the risk of unauthorized access.
Original NVD description (English source)
imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (for example) an attacker can modify imapsync's cache and overwrite files belonging to the user who runs it.