Read the docs
TI-2017-09353 Aliases CVE-2017-12628GHSA-xj7q-q94c-6wr3

Deserialization of untrusted data in Apache James

Priority LOW 35CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.

Why it matters now

EPSS 0.00759 55th percentileScored 2026-11-07
Fix Fixed org.apache.james:james-project (Maven): 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache James3.0.0—No fix listedCNA
—org.apache.james:james-project (Maven)before 3.0.13.0.1Patch availableGHSA-xj7q-q94c-6wr3
  • Apache James VendorApache Affected 3.0.0 Fixed in — No fix listed CNA
  • org.apache.james:james-project (Maven) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-xj7q-q94c-6wr3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:james_server:*:*:*:*:*:*:*:*up to 3.0.0VulnerableApache
  • cpe:2.3:a:apache:james_server:*:*:*:*:*:*:*:* Versions up to 3.0.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-xj7q-q94c-6wr3 org.apache.james:james-project (Maven) Fixed in 3.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12628
  2. 2026-10-03 Alias added: GHSA-xj7q-q94c-6wr3

References

Advisory 1

Other 4

  • TI-2015-06317 Apache James Server 2.3.2, when configured with file-based user repositories, allows… CVSS 3.0HIGH 8.1
  • TI-2024-24869 Apache James: denial of service through the use of IMAP literals CVSS 3.1HIGH 8.6
  • TI-2024-30645 Apache James: denial of service through JMAP HTML to text conversion CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences