PT-2024-14172 · Apache · Apache James

Arnout Engelen + 1 · Published 2024-02-27 · Updated 2025-05-05 · CVE-2023-51518

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache James versions prior to 3.7.5 and 3.8.0

Description The issue concerns the exposure of a JMX endpoint on localhost, which is subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadget, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default, the JMX endpoint is only bound locally.

Recommendations

• Upgrade to a non-vulnerable Apache James version
• Run Apache James isolated from other processes (docker - dedicated virtual machine)
• If possible, turn off JMX

Fix

LPE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-51518

GHSA-PX7W-C9GW-7GJ3

Affected Products

Apache James

References · 9

• https://osv.dev/vulnerability/GHSA-px7w-c9gw-7gj3 · Vendor Advisory
• https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-51518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51518 · Security Note
• https://t.me/cvenotify/72420 · Telegram Post
• https://twitter.com/RedPacketSec/status/1762418639930544325 · Twitter Post
• https://twitter.com/CVEnew/status/1762408732846096887 · Twitter Post
• https://t.me/cvenotify/91816 · Telegram Post
• https://t.me/cvenotify/120891 · Telegram Post