CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX

2023-04-0307:59:13

CWE-862

apache

www.cve.org

apache james server

privilege escalation

cve-2023-26269

jmx

authentication

administrators

guice users

0.0004 Low

EPSS

Percentile

5.1%

JSON

Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a
malicious local user.

Administrators are advised to disable JMX, or set up a JMX password.

Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache James server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "3.7.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]