PoC Index

CVE-2023-26269

HIGH 7.8EPSS 0.7%

Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user.Administrators are advised to disable JMX, or set up a JMX password.Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.

CVSS v3.1
7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.65% chance of exploitation in the next 30 days, 49th percentile
Published
2023-04-03
Updated
2025-02-13

Proof-of-concept exploits (1)

References

Related