Apache James Server OS Command Injection

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-7611 · ADVISORY
• blogs.apache.org/james/entry/apache_james_server_2_3 · WEB
• web.archive.org/web/20201207092339/http://www.securityfocus.com/archive/1/536575/100/0/threaded · WEB
• packetstormsecurity.com/files/133798/Apache-James-Server-2.3.2-Arbitrary-Command-Execution.html · WEB
• packetstormsecurity.com/files/156463/Apache-James-Server-2.3.2-Insecure-User-Creation-Arbitrary-File-Write.html · WEB
• openwall.com/lists/oss-security/2015/09/30/7 · WEB
• openwall.com/lists/oss-security/2015/10/01/2 · WEB
• securityfocus.com/archive/1/536575/100/0/threaded

Autres vulnérabilités de org.apache.james:james-server

• CVE-2023-51747ÉLEVÉE 7.1Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create…
• CVE-2023-51518CRITIQUE 9.8Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted…
• CVE-2022-45935MOYENNE 5.5Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user da…
• CVE-2022-28220ÉLEVÉE 7.5Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-202…
• CVE-2022-22931MOYENNE 4.3Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store …