PT-2022-15740 · Apache · Apache James Server

Jaroslav Lobačevski · Published 2022-02-07 · Updated 2022-02-15 · CVE-2022-22931

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache James Server versions prior to 3.6.2

Description The issue enables a user to access other users' data stores, limited to user names being prefixed by the value of the username being used. This is due to a path traversal vulnerability where the fix does not prepend delimiters upon valid directory validations. Affected implementations include the maildir mailbox store and the Sieve file repository.

Recommendations For versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the maildir mailbox store and the Sieve file repository to minimize the risk of exploitation. Avoid using usernames that could be prefixed by other usernames to limit the potential for data access by other users.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-22931

GHSA-V84G-CF5J-XJQX

Affected Products

Apache James Server

References · 10

• https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22931 · Security Note
• https://osv.dev/vulnerability/GHSA-v84g-cf5j-xjqx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22931 · Vendor Advisory
• https://github.com/apache/james-project · Note
• https://github.com/apache/james-project/pull/877/commits/b1e891a9e5eeadfa1d779ae50f21c73efe4d2fc7 · Note
• https://github.com/apache/james-project/pull/877 · Note
• https://openwall.com/lists/oss-security/2022/02/07/1 · Note
• https://t.me/cibsecurity/36971 · Telegram Post
• https://t.me/cvenotify/26394 · Telegram Post