Known vulnerabilities in the org.apache.james:james-server-guice-jmx package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Deserialization of Untrusted Data org.apache.james:james-server-guice-jmx is a JMX for Guice implementation of James server Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the exposure of a JMX endpoint on localhost that is subject to pre-authentication deserialization of untrusted data. An attacker can leverage a deserialization gadget as part of an exploit chain that could result in privilege escalation. Note: This is only exploitable if the JMX endpoint is bound locally and accessible to the attacker. How to fix Deserialization of Untrusted Data? Upgrade `org.apache.james:james-server-guice-jmx` to version 3.7.5, 3.8.1 or higher.	[,3.7.5)[3.8.0,3.8.1)

Deserialization of Untrusted Data

org.apache.james:james-server-guice-jmx is a JMX for Guice implementation of James server

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the exposure of a JMX endpoint on localhost that is subject to pre-authentication deserialization of untrusted data. An attacker can leverage a deserialization gadget as part of an exploit chain that could result in privilege escalation.

Note:

This is only exploitable if the JMX endpoint is bound locally and accessible to the attacker.

How to fix Deserialization of Untrusted Data?

Upgrade org.apache.james:james-server-guice-jmx to version 3.7.5, 3.8.1 or higher.

[,3.7.5)[3.8.0,3.8.1)

Go back to all versions of this package