apache james vulnerabilities

Latest apache james CVEs

Newest publication first

1. CVE-2021-40110 Denial of Service in Apache James

   Published 2022-01-04

   High·CVSS 7.5

   In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which en...

2. CVE-2021-40525 Path traversal in Apache James

   Published 2022-01-04

   Critical·CVSS 9.1 EPSS 3.8%

   Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassa...

3. CVE-2021-40111 Infinite Loop in Apache James

   Published 2022-01-04

   Medium·CVSS 6.5 EPSS 2.2%

   In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack....

4. CVE-2021-38542 Command Injection in Apache James

   Published 2022-01-04

   Medium·CVSS 5.9 EPSS 2.3%

   Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.

5. CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox

   Published 2019-04-17

   Critical·CVSS 9.8 EPSS 9.5%

   Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

6. CVE-2006-2806 The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.

   Published 2006-06-05

   High·CVSS 7.8

   The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.

7. CVE-2004-2650 Apache James Denial of Service

   Published 2005-12-09

   Medium·CVSS 4.9

   Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.