Vulnerability · Published Jan 4, 2022 · Assigned by apache
CVE-2021-40525Sieve file storage vulnerable to path traversal attacks
Critical 9.1
In plain English
A critical-severity path traversal in Apache James from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.james:james-server | 3.6.1 | GHSA-c38m-7h53-g9v4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache James | Apache James – through 3.6.0 |
Weakness: CWE-22
References
- https://www.openwall.com/lists/oss-security/2022/01/04/4 x_refsource_MISC
- [oss-security] 20220104 CVE-2021-40525: Apache James: Sieve file storage vulnerable to path traversal attacks mailing-list, x_refsource_MLIST
- [oss-security] 20220207 CVE-2022-22931: Path traversal in Apache James mailing-list, x_refsource_MLIST