Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12ODRnLWNmNWoteGpxeM0poQ

Path Traversal in Apache James Server

Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

Permalink: https://github.com/advisories/GHSA-v84g-cf5j-xjqx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12ODRnLWNmNWoteGpxeM0poQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-v84g-cf5j-xjqx, CVE-2022-22931
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-22931
• https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr
• https://www.openwall.com/lists/oss-security/2022/02/07/1
• https://github.com/apache/james-project/pull/877
• https://github.com/apache/james-project/pull/877/commits/b1e891a9e5eeadfa1d779ae50f21c73efe4d2fc7
• https://github.com/advisories/GHSA-v84g-cf5j-xjqx

Repository: https://github.com/apache/james-project
Blast Radius: 0.0

Affected Packages