{"id":"CVE-2023-34204","details":"imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (for example) an attacker can modify imapsync's cache and overwrite files belonging to the user who runs it.","modified":"2026-07-15T01:48:58.118580251Z","published":"2023-05-30T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34204.json","cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34204.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34204"},{"type":"REPORT","url":"https://github.com/imapsync/imapsync/issues/399"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imapsync/imapsync","events":[{"introduced":"0"},{"fixed":"4ec979525b64fa5c84b8fd43fac4c38eaae07ff7"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.229"},{"last_affected":"2.229"}],"source":["DESCRIPTION","CPE_RANGE"],"cpe":"cpe:2.3:a:imapsync_project:imapsync:*:*:*:*:*:*:*:*"}}],"versions":["imapsync-2.200","imapsync-2.178","imapsync-2.140","1.977","imapsync-1.945","imapsync-1.921","imapsync-1.920","imapsync-1.882","imapsync-1.836","imapsync-1.727","imapsync-1.684","imapsync-1.678","imapsync-1.670","imapsync-1.644","imapsync-1.637","imapsync-1.607","imapsync-1.596","imapsync-1.592","imapsync-1.584","imapsync-1.580","imapsync-1.569","imapsync-1.567","imapsync-1.564","imapsync-1.558","imapsync-1.555","imapsync-1.547","imapsync-1.542","imapsync-1.536","imapsync-1.525","imapsync-1.518","imapsync-1.516","imapsync-1.508","imapsync-1.504","imapsync-1.500","imapsync-1.498","imapsync-1.488","imapsync-1.487","imapsync-1.484","imapsync-1.480","imapsync-1.476","imapsync-1.468","imapsync-1.463","imapsync-1.456","imapsync-1.452","imapsync-1.446","imapsync-1.434","imapsync-1.422","imapsync-1.411","imapsync-1.404","imapsync-1.398","imapsync-1.366","imapsync-1.350","imapsync-1.344","imapsync-1.343","imapsync-1.342","imapsync-1.340","imapsync-1.337","imapsync-1.333","imapsync-1.331","imapsync-1.327","imapsync-1.321","imapsync-1.318","imapsync-1.315","imapsync-1.311","imapsync-1.310","imapsync-1.303","imapsync-1.300","imapsync-1.299","imapsync-1.293","imapsync-1.286","imapsync-1.285","imapsync-1.284","imapsync-1.267","imapsync-1.264","imapsync-1.261","imapsync-1.260","imapsync-1.255","imapsync-1.252","imapsync-1.250","imapsync-1.249","imapsync-1.241","imapsync-1.239","imapsync-1.233","imapsync-1.223","imapsync-1.219","imapsync-1.217","imapsync-1.209","imapsync-1.204","imapsync-1.213","imapsync-1.200","imapsync-1.197","imapsync-1.201","imapsync-1.194","imapsync-1.190","imapsync-1.195","imapsync-1.182","imapsync-1.181","imapsync-1.188","imapsync-1.180","imapsync-1.179","imapsync-1.177","imapsync-1.175","imapsync-1.178","imapsync-1.171","imapsync-1.169","imapsync-1.172","imapsync-1.167","imapsync-1.166","imapsync-1.168","imapsync-1.164","imapsync-1.163","imapsync-1.161","imapsync-1.158","imapsync-1.156","imapsync-1.159","imapsync-1.153","imapsync-1.152","imapsync-1.155","imapsync-1.145","imapsync-1.144","imapsync-1.147","imapsync-1.149","imapsync-1.142","imapsync-1.140","imapsync-1.143","imapsync-1.139","imapsync-1.137","imapsync-1.136","imapsync-1.133","imapsync-1.132","imapsync-1.135","imapsync-1.128","imapsync-1.127","imapsync-1.129","imapsync-1.125","imapsync-1.123","imapsync-1.121","imapsync-1.124","imapsync-1.118","imapsync-1.116","imapsync-1.120","imapsync-1.111","imapsync-1.110","imapsync-1.112","imapsync-1.115","imapsync-1.108","imapsync-1.107","imapsync-1.106","imapsync-1.103","imapsync-1.102","imapsync-1.99","imapsync-1.98","imapsync-1.95","imapsync-1.94","imapsync-1.96","imapsync-1.89","imapsync-1.88","imapsync-1.90","imapsync-1.91","imapsync-1.84","imapsync-1.83","imapsync-1.86","imapsync-1.87","imapsync-1.77","imapsync-1.76","imapsync-1.80","imapsync-1.82","imapsync-1.72","imapsync-1.71","imapsync-1.74","imapsync-1.75","imapsync-1.64","imapsync-1.55","imapsync-1.65","imapsync-1.68","imapsync-1.48","imapsync-1.47","imapsync-1.53","imapsync-1.42","imapsync-1.40","imapsync-1.43","imapsync-1.44","imapsync-1.31","imapsync-1.30","imapsync-1.37","imapsync-1.27","imapsync-1.25","imapsync-1.28","imapsync-1.29","imapsync-1.15","imapsync-1.14","imapsync-1.20","imapsync-1.22","imapsync-1.11","imapsync-1.10","imapsync-1.12","imapsync-1.13","imapsync-1.7","imapsync-1.6","imapsync-1.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34204.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}