Skip to content
OpenAdvisories

Package · Maven

org.apache.james:james-server

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-51518 Public exploit

    Apache James server: Privilege escalation via JMX pre-authentication deserialisation

    Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privile…

    Apache Software Foundation Apache James server org.apache.james:james-server Maven
  • Medium —
    CVE-2022-22931 Public exploit

    Path traversal in Apache James 3.6.1

    Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by …

    Apache Software Foundation Apache James org.apache.james:james-server Maven
  • High 8.1
    CVE-2015-7611 Public exploit EPSS 69%

    Apache James Server OS Command Injection

    Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

    org.apache.james:james-server Maven