PT-2017-12610 · Apache · Apache James

Publicado 2017-10-20 · Atualizado 2022-05-17 · CVE-2017-12628

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache James versions prior to 3.0.1

Description The issue concerns a java de-serialization problem in the JMX server embedded in Apache James, which can be exploited to execute arbitrary commands. This can be used for privilege escalation, as the JMX socket is exposed by default only on the local host.

Recommendations For versions prior to 3.0.1, upgrade to release 3.0.1 to resolve the issue.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-12628

GHSA-XJ7Q-Q94C-6WR3

Produtos afetados

Apache James

Referências · 8

• https://github.com/apache/james-project · Nota
• https://mail-archive.com/[e-mail]/msg15633.html · Nota
• https://mail-archive.com/server-user%40james.apache.org/msg15633.html · Nota
• https://web.archive.org/web/20210124113233/http://securityfocus.com/bid/101532 · Nota
• https://osv.dev/vulnerability/GHSA-xj7q-q94c-6wr3 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-12628 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12628 · Nota de Segurança
• http://securityfocus.com/bid/101532 · Nota