Not rated
CVE-2023-26269 Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default
Description
Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache James server 3.7 | earliest → 3.7.3 | No fix stated |
| james_server 3.7 | earliest → 3.7.3 | No fix stated |
Other CVEs of Apache James server
The 6 CVEs of Apache James server →
CVE-2024-37358
Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from…
8.6
High
CVE-2024-45626
Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded…
6.5
Medium
CVE-2023-51747
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling
Not rated
CVE-2023-51518
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication…
Not rated