~ / search / GHSA-v84g-cf5j-xjqx

GHSA-v84g-cf5j-xjqx

Path Traversal in Apache James Server

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-22931

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.james:james-server < 3.6.2 3.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

References

External links from the advisory. They lead to third-party sites.