Arbitrary Command Injection Affecting org.apache.james:apache-james-mpt-smtp-core package, versions [0,3.6.2)
Threat Intelligence
EPSS
0.08% (35th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEJAMES-2329151
- published 4 Jan 2022
- disclosed 4 Jan 2022
- credit Benoit Tellier, Raphael Ouazana
Introduced: 4 Jan 2022
CVE-2021-38542 Open this link in a new tabHow to fix?
Upgrade org.apache.james:apache-james-mpt-smtp-core to version 3.6.2 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Command Injection via the STARTTLS command. This can lead to a leak of sensible information.
Note: another remediation option is to deactivate STARTTLS and rely solely on explicit TLS for mail protocols, including SMTP, IMAP and POP3.
CVSS Scores
version 3.1