CVE-2023-51518

CVSS V2 None CVSS V3 None

Description

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to: - Upgrade to a non-vulnerable Apache James version - Run Apache James isolated from other processes (docker - dedicated virtual machine) - If possible turn off JMX

Overview

CVE ID
CVE-2023-51518

Assigner
apache

Vulnerability Status
PUBLISHED

Published Version
2024-02-27T09:09:31.579Z

Last Modified Date
2024-02-27T09:09:31.579Z

Weakness Enumerations

CWE	URL
CWE-502	http://cwe.mitre.org/data/definitions/502.html

References

Reference URL	Reference Tags
https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or	vendor-advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-51518
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51518

History

Created	Old Value	New Value	Data Type	Notes
2024-06-24 18:44:36				Added to TrackCVE