High severity · published Oct 20, 2017
CVE-2017-12628
The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands
7.8
CVSS
0.8%
EPSS
No
On KEV
Description
The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
James Server · Apache
through 3.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12628
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12628
Third Party Advisory
http://www.securityfocus.com/bid/101532
www.mail-archive.com
https://www.mail-archive.com/server-user%40james.apache.org/msg15633.html
More from James Server
9.8
CVE-2023-51518
Apache James server: Privilege escalation via JMX pre-authentication deserialisation
8.1
CVE-2015-7611
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors
7.8
CVE-2023-26269
Apache James server: Privilege escalation through unauthenticated JMX
7.5
CVE-2024-37358
Apache James: denial of service through the use of IMAP literals
7.5
CVE-2024-45626
Apache James: denial of service through JMAP HTML to text conversion