Non notée
CVE-2023-26269 Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default
Description
Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache James server 3.7 | premières → 3.7.3 | Pas de correctif indiqué |
| james_server 3.7 | premières → 3.7.3 | Pas de correctif indiqué |
Autres CVE de Apache James server
Les 6 CVE de Apache James server →
CVE-2024-37358
Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from…
8.6
Élevée
CVE-2024-45626
Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded…
6.5
Moyenne
CVE-2023-51747
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling
Non notée
CVE-2023-51518
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication…
Non notée