CVE-2021-40525

Опубликовано: 04 янв. 2022

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

Ссылки

http://www.openwall.com/lists/oss-security/2022/01/04/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/02/07/1
Mailing List
Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/01/04/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/04/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/02/07/1
Mailing List
Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/01/04/4
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*

Версия до 3.6.2 (исключая)

EPSS

Процентиль: 86%

0.02773

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-c38m-7h53-g9v4