CVE-2021-40525 Sieve file storage vulnerable to path traversal attacks

What is CVE-2021-40525?

CVE-2021-40525 is a critical vulnerability in Apache James, published on 4 Jan 2022.

Official description

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

Weakness: CWE-22

Which versions are affected by CVE-2021-40525?

2 open source packages ship an affected version, including org.apache.james:james-server. It affects 1 product.

Products include Apache James.

How do I fix CVE-2021-40525?

Upgrade org.apache.james:james-server to 3.6.1 or later.

Is CVE-2021-40525 being exploited?

There is no known exploitation of CVE-2021-40525 in the wild and no public exploit code.

Other vulnerabilities in Apache James

• CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation Critical 9.8
• CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox Critical 9.8
• CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX High 7.8
• CVE-2006-2806 Denial of service in n/a High 7.8
• CVE-2022-28220 STARTTLS command injection in Apache JAMES High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c38m-7h53-g9v4.