Search for packages
| purl | pkg:maven/org.apache.james/james-server@3.7.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6gfs-f46a-3qeb
Aliases: CVE-2023-51518 GHSA-px7w-c9gw-7gj3 |
Apache James server: Privilege escalation via JMX pre-authentication deserialization Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to: - Upgrade to a non-vulnerable Apache James version - Run Apache James isolated from other processes (docker - dedicated virtual machine) - If possible turn off JMX |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-vv9x-5ab5-yfgc
Aliases: CVE-2022-45935 GHSA-v6vp-62vc-84qw |
Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-k6dw-17nc-xbd5 | Apache James vulnerable to buffering attack Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests. |
CVE-2022-28220
GHSA-w45j-f5g5-w94x |