Not rated
CVE-2017-12628 The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization…
Description
The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache James | 3.0.0 | No fix stated |
References
- [server-user] 20171019 Announce: Apache James 3.0.1 security release www.mail-archive.com
- 101532 www.securityfocus.com
Timeline
- Published
- Last modified
Other CVEs of Apache James
The 7 CVEs of Apache James →
CVE-2022-28220
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…
Not rated
CVE-2022-22931
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations
Not rated
CVE-2021-40525
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
Not rated
CVE-2021-40111
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP…
Not rated