CVE-2022-22931— Path traversal in Apache James 3.6.1
Quick assessment
Affected
Apache Software Foundation Apache James
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache James是美国阿帕奇（Apache）基金会的一个完全用 Java 编写的开源 Smtp 和 Pop3 邮件传输代理和 Nntp 新闻服务器。 Apache James 中存在路径遍历漏洞，该漏洞源于产品在访问目录时缺少有效的权限验证。攻击者可通过该漏洞访问其他用户数据存储区。以下产品及版本受到影响：Apache James 3.6.1 之前版本。
Possible ATT&CK Techniques 1 AI
T1552.004 · Private Keys
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-22931
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path traversal in Apache James 3.6.1
Source: CVE Program / CVE List V5
Vulnerability Description
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache James 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache James是美国阿帕奇（Apache）基金会的一个完全用 Java 编写的开源 Smtp 和 Pop3 邮件传输代理和 Nntp 新闻服务器。 Apache James 中存在路径遍历漏洞，该漏洞源于产品在访问目录时缺少有效的权限验证。攻击者可通过该漏洞访问其他用户数据存储区。以下产品及版本受到影响：Apache James 3.6.1 之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache James | Apache James 3.6.1 | - |
|
II. Public POCs for CVE-2022-22931
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/shoucheng3/asf__james-project_CVE-2022-22931_3-6-0 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-22931
请登录查看更多情报信息。
Mailing List Discussions for CVE-2022-22931 (1)
-
https://www.openwall.com/lists/oss-security/2022/02/07/1 x_refsource_MISC
IV. Related Vulnerabilities
Same product: Apache James
-
CVE-2022-28220
STARTTLS command injection in Apache JAMES -
CVE-2021-40525
Sieve file storage vulnerable to path traversal attacks -
CVE-2021-40111
Apache James IMAP parsing Denial Of Service -
CVE-2021-40110
Apache James IMAP vulnerable to a ReDoS -
CVE-2021-38542
Apache James vulnerable to STARTTLS command injection (IMAP
Same vendor: Apache Software Foundation
-
CVE-2026-74848
Apache APISIX: Cross-user response poisoning in serverless p -
CVE-2026-75005
Apache APISIX: Unauthenticated CPU-exhaustion DoS -
CVE-2026-75020
Apache APISIX: ldap-auth plugin cross-subtree identity imper -
CVE-2026-63041
Apache APISIX: attach-consumer-label does not strip client-s -
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end
Same weakness: CWE-22
-
CVE-2026-81716
openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal -
CVE-2026-79653
SW360多版本附件上传任意文件路径穿越 -
CVE-2026-40526
Volmarg Personal Management System Path Traversal via get-fi -
CVE-2026-81743
Flowintel Arbitrary Log File Path Allows Remote Code Executi -
CVE-2026-81560
blackms aistack Static File server.ts path traversal
V. Comments for CVE-2022-22931
No comments yet