CVE-2017-12628
HIGHApache James Server < 3.0.0 - Insecure Deserialization
Title source: ruleDescription
The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.
Scores
CVSS v3
7.8
EPSS
0.0014
EPSS Percentile
34.1%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
Status
draft
Affected Products (2)
apache/james_server
< 3.0.0
org.apache.james/james-project
< 3.0.1Maven
Timeline
Published
Oct 20, 2017
Tracked Since
Feb 18, 2026