org.apache.james:james-server-guice-jmx@3.6.0 vulnerabilities
latest version
3.8.1
latest non vulnerable version
first published
7 years ago
latest version published
10 months ago
licenses detected
- [3.0.0-RC1,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.james:james-server-guice-jmx package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.james:james-server-guice-jmx is a JMX for Guice implementation of James server Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the exposure of a JMX endpoint on localhost that is subject to pre-authentication deserialization of untrusted data. An attacker can leverage a deserialization gadget as part of an exploit chain that could result in privilege escalation. Note: This is only exploitable if the JMX endpoint is bound locally and accessible to the attacker. How to fix Deserialization of Untrusted Data? Upgrade | [,3.7.5)[3.8.0,3.8.1) |
org.apache.james:james-server-guice-jmx is a JMX for Guice implementation of James server Affected versions of this package are vulnerable to Improper Authorization due to not requiring admin authentication on the JMX management service by default, which allows privilege escalation. How to fix Improper Authorization? Upgrade | [,3.7.4) |