CVE-2017-12628

CWE-502 — Deserialization of Untrusted Data7 documents5 sources
Severity
7.8HIGH
EPSS
0.1%
top 65.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache James ServerApache Software Foundation Apache James
Timeline
PublishedOct 20
Latest updateMay 17

Description

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

🔴Vulnerability Details

3
OSV
Apache James Privilege Escalation↗2022-05-17
▶
GHSA
Apache James Privilege Escalation↗2022-05-17
▶
CVEList
CVE-2017-12628: The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to exe↗2017-10-20
▶

💬Community

3
Bugzilla
CVE-2017-12628 apache-james-project: Java deserialization in the JMX server↗2017-10-20
▶
Bugzilla
CVE-2017-12628 apache-james-project: Java deserialization in the JMX server [fedora-all]↗2017-10-20
▶
Bugzilla
CVE-2017-12628 apache-james-project: Java deserialization in the JMX server [epel-7]↗2017-10-20
▶