CVE-2023-51747

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-51747
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-51747.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-51747
Aliases
Published
2024-02-27T13:08:01Z
Modified
2026-08-12T03:51:25Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
Summary
SMTP smuggling in Apache James
Details

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.

A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.

The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.

We recommend James users to upgrade to non vulnerable versions.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51747.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "3.7.4"
                },
                {
                    "introduced": "3.8"
                },
                {
                    "last_affected": "3.8.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/james-project

Affected ranges

Type
GIT
Repo
https://github.com/apache/james-project
Events
Introduced
795028ac33df5ca103cf7d34fbead907a62ce197
Last Affected
19fd2ec1efae679618d5fdc56c639773c1c87122
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:apache:james:3.7.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:james:3.8.1:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.7.5"
        },
        {
            "last_affected": "3.7.5"
        },
        {
            "introduced": "3.8.1"
        },
        {
            "last_affected": "3.8.1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*
3.7.5
3.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-51747.json"