Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-22931

Path traversal in Apache James 3.6.1

Description

Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache James

  • Apache James 3.6.1affected

References