Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 03/04/2023 Updated: 18/04/2023

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 0

Apache James server version 3.7.3 and previous versions provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache james

CVE-2023-26269: Misconfigured JMX in Apache James

CVE-2023-26269: Misconfigured JMX in Apache James By default Apache James opens a JMXRMI service that listens on localhost, port 9999 Because the JMX is misconfigured to allow unauthenticated access, an attacker that has local access to the machine running James can use a “MLet attack” in order to load arbitrary MBeans and execute malicious Java code Because the a

CWE-862 https://lists.apache.org/thread/2z44rg93pflbjhvbwy3xtz505bx41cbs http://www.openwall.com/lists/oss-security/2023/04/18/3 https://nvd.nist.gov https://github.com/mbadanoiu/CVE-2023-26269

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-26269

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect