CVE-2022-22931

Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@apache.org

Published

2022-02-07

Last modified

2024-08-03

Weaknesses

CWE-22

Affected products

• James (Apache)
• Apache James (Apache Software Foundation)

References

• https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr
• https://www.openwall.com/lists/oss-security/2022/02/07/1