Headline
GHSA-w7r6-v4j7-h94w: Apache James server's JMX management service vulnerable to privilege escalation by local user
Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.
Apache James server’s JMX management service vulnerable to privilege escalation by local user
Moderate severity GitHub Reviewed Published Apr 3, 2023 to the GitHub Advisory Database • Updated Apr 3, 2023
Related news
Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.