CVE-2022-22931 Path traversal in Apache James 3.6.1

2022-02-0718:50:10

CWE-22

apache

www.cve.org

6.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.3%

JSON

Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

CNA Affected

[
  {
    "product": "Apache James",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache James 3.6.1"
      }
    ]
  }
]