| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.james:james-server | < 3.6.2 | 3.6.2 |
| james | = 3.6.1 |
Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free