GHSA-v84g-cf5j-xjqx

Source

https://github.com/advisories/GHSA-v84g-cf5j-xjqx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-v84g-cf5j-xjqx/GHSA-v84g-cf5j-xjqx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v84g-cf5j-xjqx

Aliases

CVE-2022-22931

Published

2022-02-08T00:00:34Z

Modified

2024-12-05T05:43:34Z

Summary

Path Traversal in Apache James Server

Details

Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-02-08T20:38:52Z",
    "nvd_published_at":  "2022-02-07T19:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.apache.james:james-server

Package

Name: org.apache.james:james-server; View open source insights on deps.dev
Purl: pkg:maven/org.apache.james/james-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.6.2

Affected versions

3.*

3.0-beta2

3.0-beta3

3.0-beta4

3.0.0-beta5

3.0-M1

3.0-M2

3.0.0-RC1

3.0.0

3.0.1

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.6.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-v84g-cf5j-xjqx/GHSA-v84g-cf5j-xjqx.json"