by Kastro
Paper/Archive/CVE-2021-40525

CVE-2021-40525

Apache Software Foundation Apache James — Sieve file storage vulnerable to path traversal attacks

EPSS 4%CVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 90.1.901 × 2018.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

Affected

ProductAffectedFixed inSource
Apache JamesApache James – 3.6.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refopenwall.com/lists/oss-security/2022/01/04/4refopenwall.com/lists/oss-security/2022/01/04/4refopenwall.com/lists/oss-security/2022/02/07/1