PT-2017-12610 · Apache · Apache James

Published 2017-10-20 · Updated 2022-05-17 · CVE-2017-12628

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache James versions prior to 3.0.1

Description The issue concerns a java de-serialization problem in the JMX server embedded in Apache James, which can be exploited to execute arbitrary commands. This can be used for privilege escalation, as the JMX socket is exposed by default only on the local host.

Recommendations For versions prior to 3.0.1, upgrade to release 3.0.1 to resolve the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-12628

GHSA-XJ7Q-Q94C-6WR3

Affected Products

Apache James

References · 8

• https://osv.dev/vulnerability/GHSA-xj7q-q94c-6wr3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12628 · Security Note
• https://github.com/apache/james-project · Note
• https://mail-archive.com/[e-mail]/msg15633.html · Note
• https://mail-archive.com/server-user%40james.apache.org/msg15633.html · Note
• https://web.archive.org/web/20210124113233/http://securityfocus.com/bid/101532 · Note
• http://securityfocus.com/bid/101532 · Note