CVE-2021-40525

CVE-2021-40525: Sieve file storage vulnerable to path traversal attacks

Vendor Apache Software Foundation

Product Apache James

Weakness CWE-22 · Path traversal

Published January 4, 2022

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

Key dates

02Disclosure timeline

January 4, 2022 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-40525 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html