GitHub Advisoryadvisory · Maven

GHSA-v84g-cf5j-xjqx Path Traversal in Apache James Server

MEDIUM Published 2022-02-08 Modified 2022-02-08 Official page ↗
Aliases
CVE-2022-22931
Ecosystem
Maven
Packages
org.apache.james:james-server
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2022-02-08

Affected packages

• Maven org.apache.james:james-server: < 3.6.2 → fixed in 3.6.2

Description

Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

Related

Alias · CVE (1)

  • CVE-2022-22931 Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References