Read the docs
TI-2023-28170 Aliases CVE-2023-51518GHSA-px7w-c9gw-7gj3

Apache James server: Privilege escalation via JMX pre-authentication deserialisation

Priority MEDIUM 51CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to:  - Upgrade to a non-vulnerable Apache James version  - Run Apache James isolated from other processes (docker - dedicated virtual machine)  - If possible turn off JMX

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01189 68th percentileScored 2026-11-07
Fix Fixed org.apache.james:james-server (Maven): 3.7.5, 3.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache James serverup to 3.7.4; 3.8 – 3.8.0—No fix listedCNA
—org.apache.james:james-server (Maven)before 3.7.53.7.5Patch availableGHSA-px7w-c9gw-7gj3
—org.apache.james:james-server (Maven)3.8.0 to before 3.8.13.8.1Patch availableGHSA-px7w-c9gw-7gj3
  • Apache James server VendorApache Affected up to 3.7.4; 3.8 – 3.8.0 Fixed in — No fix listed CNA
  • org.apache.james:james-server (Maven) Vendor— Affected before 3.7.5 Fixed in 3.7.5 Patch available GHSA-px7w-c9gw-7gj3
  • org.apache.james:james-server (Maven) Vendor— Affected 3.8.0 to before 3.8.1 Fixed in 3.8.1 Patch available GHSA-px7w-c9gw-7gj3

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:james:3.7.5:*:*:*:*:*:*:*3.7.5VulnerableApache
cpe:2.3:a:apache:james:3.8.0:*:*:*:*:*:*:*3.8.0VulnerableApache
  • cpe:2.3:a:apache:james:3.7.5:*:*:*:*:*:*:* Versions 3.7.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:james:3.8.0:*:*:*:*:*:*:* Versions 3.8.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-px7w-c9gw-7gj3 org.apache.james:james-server (Maven) Fixed in 3.7.5 Advisory →
  • Fix · GHSA-px7w-c9gw-7gj3 org.apache.james:james-server (Maven) Fixed in 3.8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-51518
  2. 2026-10-03 Alias added: GHSA-px7w-c9gw-7gj3

References

Advisory 2

  • TI-2019-00201 XML external entity injection in Apache PDFBox CVSS 3.1CRITICAL 9.8
  • TI-2021-17565 Sieve file storage vulnerable to path traversal attacks CVSS 3.1CRITICAL 9.1
  • TI-2006-02714 The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows… CVSS 2.0HIGH 7.8
  • TI-2021-17305 Apache James IMAP vulnerable to a ReDoS CVSS 3.1HIGH 7.5
  • TI-2023-11431 Apache James server: Privilege escalation through unauthenticated JMX CVSS 3.1HIGH 7.8
  • TI-2022-11006 STARTTLS command injection in Apache JAMES CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences