Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr | Mailing List Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2022/02/07/1 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr | Mailing List Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2022/02/07/1 | Mailing List Third Party Advisory |
Configurations
History
21 Nov 2024, 06:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr - Mailing List, Vendor Advisory | |
| References | () https://www.openwall.com/lists/oss-security/2022/02/07/1 - Mailing List, Third Party Advisory |
15 Feb 2022, 20:33
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:james:3.6.1:*:*:*:*:*:*:* | |
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| References | (MISC) https://www.openwall.com/lists/oss-security/2022/02/07/1 - Mailing List, Third Party Advisory | |
| References | (MISC) https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr - Mailing List, Vendor Advisory |
07 Feb 2022, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-07 19:15
Updated : 2024-11-21 06:47
NVD link : CVE-2022-22931
Mitre link : CVE-2022-22931
CVE.ORG link : CVE-2022-22931
JSON object : View
Products Affected
apache
- james
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')