Non notée
CVE-2021-40525 Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
Description
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache James 3.6 | premières → 3.6.0 | Pas de correctif indiqué |
Références
- www.openwall.com www.openwall.com
- [oss-security] 20220104 CVE-2021-40525: Apache James: Sieve file storage vulnerable to path traversal attacks www.openwall.com
- [oss-security] 20220207 CVE-2022-22931: Path traversal in Apache James www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache James
Les 7 CVE de Apache James →
CVE-2022-28220
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…
Non notée
CVE-2022-22931
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations
Non notée
CVE-2021-40111
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP…
Non notée
CVE-2021-40110
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a…
Non notée