Paper/Archive/CVE-2023-51518

CVE-2023-51518

Apache Software Foundation Apache James server — Apache James server: Privilege escalation via JMX pre-authentication deserialisation

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 67.9.679 × 2013.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to: - Upgrade to a non-vulnerable Apache James version - Run Apache James isolated from other processes (docker - dedicated virtual machine) - If possible turn off JMX

Affected

ProductAffectedFixed inSource

Apache James server≤ 3.7.4–CNA

Apache James server3.8 – 3.8.0–CNA

james_server≤ 3.7.4–CISA-ADP

james_server3.8–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or