CVE-2022-22931 Path traversal in Apache James 3.6.1

What is CVE-2022-22931?

CVE-2022-22931 is a medium-severity path traversal vulnerability in Apache James, published on 7 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).

Weakness: CWE-22

Which versions are affected by CVE-2022-22931?

2 open source packages ship an affected version, including org.apache.james:james-server. It affects 1 product.

Products include Apache James.

How do I fix CVE-2022-22931?

Upgrade org.apache.james:james-server to 3.6.2 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-22931 being exploited?

There is no known exploitation of CVE-2022-22931 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Apache James

• CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation Critical 9.8
• CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox Critical 9.8
• CVE-2021-40525 Sieve file storage vulnerable to path traversal attacks Critical 9.1
• CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX High 7.8
• CVE-2006-2806 Denial of service in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v84g-cf5j-xjqx.