James vulnerabilities

4 known vulnerabilities in James from Apache. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.

  CVE-2023-51747Feb 27, 2024ApacheEPSS 1.04%

  Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMT

• 9.8 Critical severity

  Apache James server: Deserialization of Untrusted Data

  CVE-2023-51518Feb 27, 2024ApacheEPSS 1.19%

  Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privileg

• 7.8 High severity

  Apache James server: Missing Authorization

  CVE-2023-26269Apr 3, 2023Apache

  Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that versio

• 7.5 High severity

  Apache James: Improper Neutralization of Special Elements used in a Command

  CVE-2022-28220Sep 8, 2022ApacheEPSS 2.03%

  Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into