GHSA-xj7q-q94c-6wr3

ghsaUSosv

Apache James Privilege Escalation

view advisory published 2022-05-17Licence: CC-BY-4.0

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-12628US	high7.8	0.76% (55th)	—	2017-10-20
The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As Ja…

references

External citations — patches, advisories, analysis.

https://github.com/apache/james-projectPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2017-12628ADVISORY
https://web.archive.org/web/20210124113233/http://www.securityfocus.com/bid/101532WEB
https://www.mail-archive.com/server-user@james.apache.org/msg15633.htmlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan