CVE-2022-22931CWE-22

Path traversal in Apache James 3.6.1

published February 7, 2022

CVSS
—
EPSS
2%
Percentile
77.8
In the wild
Unconfirmed
What it is

Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01761 · 77.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-02-07T18:50Z
EPSS history
Timeline
  • 07 FEB 18:50Z
    Path traversal in Apache James 3.6.1
    cvelistv5