Path Traversal in Apache James Server

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-22931 · ADVISORY
• apache/james-project#877 · WEB
• apache/james-project#877 · WEB
• apache/james-project · PACKAGE
• lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr · WEB
• openwall.com/lists/oss-security/2022/02/07/1 · WEB

org.apache.james:james-server のその他の脆弱性

• CVE-2023-51747高 7.1Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create…
• CVE-2023-51518緊急 9.8Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted…
• CVE-2022-45935中 5.5Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user da…
• CVE-2022-28220高 7.5Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-202…
• CVE-2021-40525緊急 9.1Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading…