What is GHSA-c38m-7h53-g9v4?

GHSA-c38m-7h53-g9v4 is a security advisory published by GitHub Security Advisories with Critical severity. Path traversal in Apache James

Which CVE IDs does GHSA-c38m-7h53-g9v4 cover?

GHSA-c38m-7h53-g9v4 covers the following CVE IDs: CVE-2021-40525. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c38m-7h53-g9v4?

GHSA-c38m-7h53-g9v4 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-c38m-7h53-g9v4?

GHSA-c38m-7h53-g9v4 affects 1 product, including: maven/org.apache.james:james-server:\u003c 3.6.1.

GHSA-c38m-7h53-g9v4CriticalCVSS 9.1

Path traversal in Apache James

Vendor

GitHub Security Advisories

Published

January 21, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-40525 →

📋 Description

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

🎯 Affected products1

maven/org.apache.james:james-server:< 3.6.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-40525
https://www.openwall.com/lists/oss-security/2022/01/04/4
http://www.openwall.com/lists/oss-security/2022/01/04/4
http://www.openwall.com/lists/oss-security/2022/02/07/1
https://github.com/advisories/GHSA-c38m-7h53-g9v4