Command Injection

2022-09-0909:22:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache james

command injection

vulnerability

imap starttls

concurrent requests

arbitrary commands

0.001 Low

EPSS

Percentile

47.0%

JSON

Apache James is vulnerable to command injection attacks. The vulnerability exists because of parser differential for IMAP STARTTLS which does not take into account concurrent requests which allows an attacker to inject and execute arbitrary commands.

CPENameOperatorVersion
apache james mpt corele3.7.0
apache james :: protocols :: netty implementationle3.7.0
apache james :: server :: imaple3.6.0
apache james :: server :: imaple3.7.0
apache james :: protocols :: apile3.7.0
apache james :: server :: managesieveeq3.7.0
apache james :: server :: managesievele3.6.2
apache james :: mpt :: corele3.7.0
apache james :: protocols :: netty implementationle3.7.0
apache james :: server :: imaple3.6.0

Name	Operator	Version
apache james mpt core	le	3.7.0
apache james :: protocols :: netty implementation	le	3.7.0
apache james :: server :: imap	le	3.6.0
apache james :: server :: imap	le	3.7.0
apache james :: protocols :: api	le	3.7.0
apache james :: server :: managesieve	eq	3.7.0
apache james :: server :: managesieve	le	3.6.2
apache james :: mpt :: core	le	3.7.0
apache james :: protocols :: netty implementation	le	3.7.0
apache james :: server :: imap	le	3.6.0