GHSA-v84g-cf5j-xjqxMedium

Path Traversal in Apache James Server

Published
February 8, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-22931 →

📋 Description

Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

🎯 Affected products1

  • maven/org.apache.james:james-server:< 3.6.2

🔗 References (6)