PT-2023-20578 · Apache · Apache James Server

Mal + 1 · Published 2023-04-03 · Updated 2024-10-23 · CVE-2023-26269

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache James server versions 3.7.3 and earlier

Description The issue allows privilege escalation by a malicious local user due to the JMX management service being provided without authentication by default. Administrators are advised to take mitigation measures.

Recommendations For Apache James server versions 3.7.3 and earlier, disable JMX or set up a JMX password to mitigate the issue. For users upgrading to version 3.7.4 or later, no action is required as a JMX password will be set up automatically for Guice users.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-26269

GHSA-W7R6-V4J7-H94W

Affected Products

Apache James Server

References · 12

• https://osv.dev/vulnerability/CVE-2023-26269 · Vendor Advisory
• https://lists.apache.org/thread/2z44rg93pflbjhvbwy3xtz505bx41cbs · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7r6-v4j7-h94w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26269 · Security Note
• https://github.com/apache/james-project · Note
• https://t.me/cvenotify/77761 · Telegram Post
• http://openwall.com/lists/oss-security/2023/04/18/3 · Note
• https://t.me/cvenotify/99185 · Telegram Post
• https://t.me/cybersecuritytechnologies/9465 · Telegram Post
• https://t.me/cvenotify/47410 · Telegram Post
• https://t.me/cvenotify/77711 · Telegram Post
• https://t.me/cvenotify/47416 · Telegram Post