Apache James Server OS Command Injection

ALTO 8.1CVE-2015-7611 · GHSA-cgvf-22vv-83h5 · Published 07/06/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.james:james-server Maven	`< 2.3.2.1`	`2.3.2.1`
james server apache	`= 2.3.2`	No fix yet

Description

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

NVD description

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2015-7611 · ADVISORY
blogs.apache.org/james/entry/apache_james_server_2_3 · WEB
web.archive.org/web/20201207092339/http://www.securityfocus.com/archive/1/536575/100/0/threaded · WEB
packetstormsecurity.com/files/133798/Apache-James-Server-2.3.2-Arbitrary-Command-Execution.html · WEB
packetstormsecurity.com/files/156463/Apache-James-Server-2.3.2-Insecure-User-Creation-Arbitrary-File-Write.html · WEB
openwall.com/lists/oss-security/2015/09/30/7 · WEB
openwall.com/lists/oss-security/2015/10/01/2 · WEB
securityfocus.com/archive/1/536575/100/0/threaded

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free