Medium
Security advisory
imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (for example) an attacker can modify imapsync's cache and overwrite files belonging to the user who runs it.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-34204
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 17:51 UTC · Revision 1
Source evidence
imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (for example) an attacker can modify imapsync's cache and overwrite files belonging to the user who runs it.
osv:CVE-2023-34204
Complete source record
{
"id": "e38c1453863e832ad2c23a9773b8433582441c5103291d680cf4319b0384e27f",
"url": "https://osv.dev/vulnerability/CVE-2023-34204",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-34204",
"summary": "imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (for example) an attacker can modify imapsync's cache and overwrite files belonging to the user who runs it.",
"evidence": "osv:CVE-2023-34204",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-34204",
"aliases": [
"CVE-2023-34204"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/imapsync/imapsync",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "4ec979525b64fa5c84b8fd43fac4c38eaae07ff7"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.229"
}
],
"source": "DESCRIPTION"
},
{
"cpe": "cpe:2.3:a:imapsync_project:imapsync:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.229"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"imapsync-2.229",
"imapsync-2.200",
"imapsync-2.178",
"imapsync-2.140",
"1.977",
"imapsync-1.945",
"imapsync-1.921",
"imapsync-1.920",
"imapsync-1.882",
"imapsync-1.836",
"imapsync-1.727",
"imapsync-1.684",
"imapsync-1.678",
"imapsync-1.670",
"imapsync-1.644",
"imapsync-1.637",
"imapsync-1.607",
"imapsync-1.596",
"imapsync-1.592",
"imapsync-1.584",
"imapsync-1.580",
"imapsync-1.569",
"imapsync-1.567",
"imapsync-1.564",
"imapsync-1.558",
"imapsync-1.555",
"imapsync-1.547",
"imapsync-1.542",
"imapsync-1.536",
"imapsync-1.525",
"imapsync-1.518",
"imapsync-1.516",
"imapsync-1.508",
"imapsync-1.504",
"imapsync-1.500",
"imapsync-1.498",
"imapsync-1.488",
"imapsync-1.487",
"imapsync-1.484",
"imapsync-1.480",
"imapsync-1.476",
"imapsync-1.468",
"imapsync-1.463",
"imapsync-1.456",
"imapsync-1.452",
"imapsync-1.446",
"imapsync-1.434",
"imapsync-1.422",
"imapsync-1.411",
"imapsync-1.404",
"imapsync-1.398",
"imapsync-1.366",
"imapsync-1.350",
"imapsync-1.344",
"imapsync-1.343",
"imapsync-1.342",
"imapsync-1.340",
"imapsync-1.337",
"imapsync-1.333",
"imapsync-1.331",
"imapsync-1.327",
"imapsync-1.321",
"imapsync-1.318",
"imapsync-1.315",
"imapsync-1.311",
"imapsync-1.310",
"imapsync-1.303",
"imapsync-1.300",
"imapsync-1.299",
"imapsync-1.293",
"imapsync-1.286",
"imapsync-1.285",
"imapsync-1.284",
"imapsync-1.267",
"imapsync-1.264",
"imapsync-1.261",
"imapsync-1.260",
"imapsync-1.255",
"imapsync-1.252",
"imapsync-1.250",
"imapsync-1.249",
"imapsync-1.241",
"imapsync-1.239",
"imapsync-1.233",
"imapsync-1.223",
"imapsync-1.219",
"imapsync-1.217",
"imapsync-1.209",
"imapsync-1.204",
"imapsync-1.213",
"imapsync-1.200",
"imapsync-1.197",
"imapsync-1.201",
"imapsync-1.194",
"imapsync-1.190",
"imapsync-1.195",
"imapsync-1.182",
"imapsync-1.181",
"imapsync-1.188",
"imapsync-1.180",
"imapsync-1.179",
"imapsync-1.177",
"imapsync-1.175",
"imapsync-1.178",
"imapsync-1.171",
"imapsync-1.169",
"imapsync-1.172",
"imapsync-1.167",
"imapsync-1.166",
"imapsync-1.168",
"imapsync-1.164",
"imapsync-1.163",
"imapsync-1.161",
"imapsync-1.158",
"imapsync-1.156",
"imapsync-1.159",
"imapsync-1.153",
"imapsync-1.152",
"imapsync-1.155",
"imapsync-1.145",
"imapsync-1.144",
"imapsync-1.147",
"imapsync-1.149",
"imapsync-1.142",
"imapsync-1.140",
"imapsync-1.143",
"imapsync-1.139",
"imapsync-1.137",
"imapsync-1.136",
"imapsync-1.133",
"imapsync-1.132",
"imapsync-1.135",
"imapsync-1.128",
"imapsync-1.127",
"imapsync-1.129",
"imapsync-1.125",
"imapsync-1.123",
"imapsync-1.121",
"imapsync-1.124",
"imapsync-1.118",
"imapsync-1.116",
"imapsync-1.120",
"imapsync-1.111",
"imapsync-1.110",
"imapsync-1.112",
"imapsync-1.115",
"imapsync-1.108",
"imapsync-1.107",
"imapsync-1.106",
"imapsync-1.103",
"imapsync-1.102",
"imapsync-1.99",
"imapsync-1.98",
"imapsync-1.95",
"imapsync-1.94",
"imapsync-1.96",
"imapsync-1.89",
"imapsync-1.88",
"imapsync-1.90",
"imapsync-1.91",
"imapsync-1.84",
"imapsync-1.83",
"imapsync-1.86",
"imapsync-1.87",
"imapsync-1.77",
"imapsync-1.76",
"imapsync-1.80",
"imapsync-1.82",
"imapsync-1.72",
"imapsync-1.71",
"imapsync-1.74",
"imapsync-1.75",
"imapsync-1.64",
"imapsync-1.55",
"imapsync-1.65",
"imapsync-1.68",
"imapsync-1.48",
"imapsync-1.47",
"imapsync-1.53",
"imapsync-1.42",
"imapsync-1.40",
"imapsync-1.43",
"imapsync-1.44",
"imapsync-1.31",
"imapsync-1.30",
"imapsync-1.37",
"imapsync-1.27",
"imapsync-1.25",
"imapsync-1.28",
"imapsync-1.29",
"imapsync-1.15",
"imapsync-1.14",
"imapsync-1.20",
"imapsync-1.22",
"imapsync-1.11",
"imapsync-1.10",
"imapsync-1.12",
"imapsync-1.13",
"imapsync-1.7",
"imapsync-1.6",
"imapsync-1.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34204.json"
}
}
],
"modified": "2026-10-28T02:30:31.190936204Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34204.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-34204",
"https://github.com/imapsync/imapsync/issues/399"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34204.json"
}
},
"related_cves": [
{
"value": "CVE-2023-34204",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 498028,
"published_at": "2023-05-30T00:00:00+00:00"
}