CVE-2023-26269

Description

Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.

Reserved 2023-02-21 | Published 2023-04-03 | Updated 2024-10-23 | Assigner apache

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

Any version
affected

Credits

Matei "Mal" Badanoiu reporter

References

lists.apache.org/thread/2z44rg93pflbjhvbwy3xtz505bx41cbs vendor-advisory

www.openwall.com/lists/oss-security/2023/04/18/3

cve.org (CVE-2023-26269)

nvd.nist.gov (CVE-2023-26269)

Download JSON