GitHub Advisoryadvisory · Maven

GHSA-c38m-7h53-g9v4 Path traversal in Apache James

CRITICAL Published 2022-01-21 Modified 2022-03-30 Official page ↗
Aliases
CVE-2021-40525
Ecosystem
Maven
Packages
org.apache.james:james-server
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2022-01-13

Affected packages

• Maven org.apache.james:james-server: < 3.6.1 → fixed in 3.6.1

Description

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

Related

Alias · CVE (1)

  • CVE-2021-40525 Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References