High severity · published Feb 27, 2024
CVE-2023-51747
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling
7.1
CVSS
1%
EPSS
No
On KEV
Description
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.
A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.
The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.
We recommend James users to upgrade to non vulnerable versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
James · Apache
3.7.5; 3.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-51747
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-51747
Mailing List
http://www.openwall.com/lists/oss-security/2024/02/27/4
Mailing List
https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko
Product
https://postfix.org/smtp-smuggling.html
Product
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
More from James
9.8
CVE-2023-51518
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data
9.8
CVE-2019-0228
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF
9.1
CVE-2021-40525
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file
7.8
CVE-2023-26269
Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default
7.5
CVE-2022-28220
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command