VulnerabilityModified
CVE-2021-40525
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file.
CRITICAL 9.1EPSS 3.71%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 3.71% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- apache/james
- Source
- security@apache.org
References
- http://www.openwall.com/lists/oss-security/2022/01/04/4Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/02/07/1Mailing List, Third Party Advisory
- https://www.openwall.com/lists/oss-security/2022/01/04/4Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/01/04/4Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/02/07/1Mailing List, Third Party Advisory
- https://www.openwall.com/lists/oss-security/2022/01/04/4Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.