apache james server vulnerabilities

Latest apache james server CVEs

Newest publication first

1. CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation

   Published 2024-02-27

   Critical·CVSS 9.8

   Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note t...

2. CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX

   Published 2023-04-03

   High·CVSS 7.8

   Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will...

3. CVE-2017-12628 Apache James Privilege Escalation

   Published 2017-10-20

   High·CVSS 7.8

   The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privil...

4. CVE-2015-7611 Apache James Server OS Command Injection

   Published 2016-06-07

   High·CVSS 8.1 EPSS 68.6% Framework module Public exploit

   Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.