CVE-2023-51747: falha de alta gravidade em Apache James server
SMTP smuggling in Apache James
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 1.0%
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.
A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.
The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.
We recommend James users to upgrade to non vulnerable versions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache James serverCVEs relacionadas — Apache James server
No mesmo produto, das mais perigosas para as menos.
CVE-2023-51518CRITICALApache James server: Privilege escalation via JMX pre-authentication deserialisationEPSS 1.2%CVE-2024-37358HIGHApache James: denial of service through the use of IMAP literalsEPSS 0.9%CVE-2024-45626MEDIUMApache James: denial of service through JMAP HTML to text conversionEPSS 0.8%CVE-2023-26269HIGHApache James server: Privilege escalation through unauthenticated JMXEPSS 0.7%CVE-2022-45935MEDIUMApache James server: Temporary File Information DisclosureEPSS 0.4%