Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-6gfs-f46a-3qeb

Summary

Apache James server: Privilege escalation via JMX pre-authentication deserialization
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.
Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.
Note that by default JMX endpoint is only bound locally.

We recommend users to:
 - Upgrade to a non-vulnerable Apache James version

 - Run Apache James isolated from other processes (docker - dedicated virtual machine)
 - If possible turn off JMX

Aliases

alias	CVE-2023-51518

alias	GHSA-px7w-c9gw-7gj3

Fixed_packages

url	pkg:maven/org.apache.james/james-server@3.7.5
purl	pkg:maven/org.apache.james/james-server@3.7.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.7.5

url	pkg:maven/org.apache.james/james-server@3.8.1
purl	pkg:maven/org.apache.james/james-server@3.8.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.8.1

Affected_packages

url pkg:maven/org.apache.james/james-server@3.0-beta2

purl pkg:maven/org.apache.james/james-server@3.0-beta2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0-beta2

url pkg:maven/org.apache.james/james-server@3.0-beta3

purl pkg:maven/org.apache.james/james-server@3.0-beta3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0-beta3

url pkg:maven/org.apache.james/james-server@3.0-beta4

purl pkg:maven/org.apache.james/james-server@3.0-beta4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0-beta4

url pkg:maven/org.apache.james/james-server@3.0.0-beta5

purl pkg:maven/org.apache.james/james-server@3.0.0-beta5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0.0-beta5

url pkg:maven/org.apache.james/james-server@3.0-M1

purl pkg:maven/org.apache.james/james-server@3.0-M1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0-M1

url pkg:maven/org.apache.james/james-server@3.0-M2

purl pkg:maven/org.apache.james/james-server@3.0-M2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0-M2

url pkg:maven/org.apache.james/james-server@3.0.0-RC1

purl pkg:maven/org.apache.james/james-server@3.0.0-RC1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0.0-RC1

url pkg:maven/org.apache.james/james-server@3.0.0

purl pkg:maven/org.apache.james/james-server@3.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0.0

url pkg:maven/org.apache.james/james-server@3.0.1

purl pkg:maven/org.apache.james/james-server@3.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.0.1

url pkg:maven/org.apache.james/james-server@3.1.0

purl pkg:maven/org.apache.james/james-server@3.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.1.0

url pkg:maven/org.apache.james/james-server@3.2.0

purl pkg:maven/org.apache.james/james-server@3.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.2.0

url pkg:maven/org.apache.james/james-server@3.3.0

purl pkg:maven/org.apache.james/james-server@3.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.3.0

url pkg:maven/org.apache.james/james-server@3.4.0

purl pkg:maven/org.apache.james/james-server@3.4.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.4.0

url pkg:maven/org.apache.james/james-server@3.5.0

purl pkg:maven/org.apache.james/james-server@3.5.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.5.0

url pkg:maven/org.apache.james/james-server@3.6.0

purl pkg:maven/org.apache.james/james-server@3.6.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vru-s5v2-dbcq

vulnerability	VCID-4q61-ksfc-aqf2

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-aqre-33na-w3d9

vulnerability	VCID-gcxw-t4m6-4bcs

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-repa-s2hq-qyfu

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.6.0

url pkg:maven/org.apache.james/james-server@3.6.2

purl pkg:maven/org.apache.james/james-server@3.6.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.6.2

url pkg:maven/org.apache.james/james-server@3.7.0

purl pkg:maven/org.apache.james/james-server@3.7.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-k6dw-17nc-xbd5

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.7.0

url pkg:maven/org.apache.james/james-server@3.7.1

purl pkg:maven/org.apache.james/james-server@3.7.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.7.1

url pkg:maven/org.apache.james/james-server@3.7.2

purl pkg:maven/org.apache.james/james-server@3.7.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-vv9x-5ab5-yfgc

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.7.2

url pkg:maven/org.apache.james/james-server@3.7.3

purl pkg:maven/org.apache.james/james-server@3.7.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gfs-f46a-3qeb

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.7.3

url pkg:maven/org.apache.james/james-server@3.7.4

purl pkg:maven/org.apache.james/james-server@3.7.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gfs-f46a-3qeb

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.7.4

url pkg:maven/org.apache.james/james-server@3.8.0

purl pkg:maven/org.apache.james/james-server@3.8.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gfs-f46a-3qeb

vulnerability	VCID-hzq7-6765-myfp

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.8.0

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2023-51518

reference_id

reference_type

scores

value	0.00439
scoring_system	epss
scoring_elements	0.6319
published_at	2026-04-24T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63096
published_at	2026-04-07T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63148
published_at	2026-04-08T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63165
published_at	2026-04-09T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63183
published_at	2026-04-11T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63168
published_at	2026-04-21T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63145
published_at	2026-04-13T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.6318
published_at	2026-04-16T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63188
published_at	2026-04-18T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63102
published_at	2026-04-02T12:55:00Z

value	0.00439
scoring_system	epss
scoring_elements	0.63132
published_at	2026-04-04T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2023-51518

reference_url

https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	9.3
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

value	CRITICAL
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-08-22T20:42:32Z/

url

https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2023-51518

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	9.3
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

value	CRITICAL
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2023-51518

reference_url

https://github.com/advisories/GHSA-px7w-c9gw-7gj3

reference_id

GHSA-px7w-c9gw-7gj3

reference_type

scores

value	CRITICAL
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-px7w-c9gw-7gj3

Weaknesses

cwe_id	502
name	Deserialization of Untrusted Data
description	The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score 9.0 - 10.0

Exploitability 0.5

Weighted_severity 9.0

Risk_score 4.5

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6gfs-f46a-3qeb

Vulnerability Instance