PT-2023-20578 · Apache · Apache James Server

Mal + 1 · Publicado 2023-04-03 · Atualizado 2024-10-23 · CVE-2023-26269

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache James server versions 3.7.3 and earlier

Description The issue allows privilege escalation by a malicious local user due to the JMX management service being provided without authentication by default. Administrators are advised to take mitigation measures.

Recommendations For Apache James server versions 3.7.3 and earlier, disable JMX or set up a JMX password to mitigate the issue. For users upgrading to version 3.7.4 or later, no action is required as a JMX password will be set up automatically for Guice users.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-26269

GHSA-W7R6-V4J7-H94W

Produtos afetados

Apache James Server

Referências · 12

• https://github.com/apache/james-project · Nota
• https://t.me/cvenotify/77761 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/04/18/3 · Nota
• https://osv.dev/vulnerability/CVE-2023-26269 · Aviso do Fabricante
• https://lists.apache.org/thread/2z44rg93pflbjhvbwy3xtz505bx41cbs · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w7r6-v4j7-h94w · Aviso do Fabricante
• https://t.me/cvenotify/99185 · Publicação no Telegram
• https://t.me/cybersecuritytechnologies/9465 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26269 · Nota de Segurança
• https://t.me/cvenotify/47410 · Publicação no Telegram
• https://t.me/cvenotify/77711 · Publicação no Telegram
• https://t.me/cvenotify/47416 · Publicação no Telegram