GHSA-c38m-7h53-g9v4

ghsaUSosv

Path traversal in Apache James

view advisory published 2022-01-21Licence: CC-BY-4.0

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-40525US	critical9.1	3.83% (90th)	—	2022-01-04
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerabilit…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2022/01/04/4WEB
http://www.openwall.com/lists/oss-security/2022/02/07/1WEB
https://github.com/apache/james-projectPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2021-40525ADVISORY
https://www.openwall.com/lists/oss-security/2022/01/04/4WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan