CVE-2023-51518

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-51518

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-51518.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-51518

Aliases

GHSA-px7w-c9gw-7gj3

Published

2024-02-27T09:15:36Z

Modified

2025-05-17T14:21:04.573958Z

Summary

[none]

Details

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally.

We recommend users to: - Upgrade to a non-vulnerable Apache James version

- Run Apache James isolated from other processes (docker - dedicated virtual machine) - If possible turn off JMX

References

https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or

Affected packages

Git / github.com/apache/james-project

Affected ranges

Type: GIT
Repo: https://github.com/apache/james-project
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

795028ac33df5ca103cf7d34fbead907a62ce197

Last affected

b967e3640f35822fd56c794b874f795442778be5

Affected versions

Other

cassandra_migration_v1_to_v2

james-project-3.*

james-project-3.0-beta5

james-project-3.0.0

james-project-3.0.0-RC1

james-project-3.0.0-beta5

james-project-3.3.0

james-project-3.4.0

james-project-3.7.0

james-project-3.7.1

james-project-3.7.2

james-project-3.7.3

james-project-3.7.4

james-project-3.7.5

james-project-3.8.0

pre-3.*

pre-3.1.0