First published: Mon Feb 07 2022(Updated: )
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
Credit: security@apache.org
Affected Software | Affected Version | How to fix |
---|---|---|
Apache James | =3.6.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this issue is CVE-2022-22931.
The severity of CVE-2022-22931 is medium.
The software affected by CVE-2022-22931 is Apache James version 3.6.1.
CVE-2022-22931 enables a user to access other users' data stores by bypassing directory validations.
Yes, there are references available for CVE-2022-22931. You can find them at the following links: [Link 1](https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr), [Link 2](https://www.openwall.com/lists/oss-security/2022/02/07/1).