What is CVE-2023-51518?

CVE-2023-51518 is a critical-severity vulnerability in Apache James, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2024-02-27.

How severe is CVE-2023-51518?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2023-51518 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Apache James

CVE-2023-51518

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to: - Upgrade to a non-vulnerable Apache James version - Run Apache James isolated from other processes (docker - dedicated virtual machine) - If possible turn off JMX

Vulnerability class: Insecure Deserialization

EPSS: 0.012 (66.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache James — versions 3.7.5, 3.8.0
Apache Software Foundation James Server — versions 0, 3.8

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

mbadanoiu/CVE-2023-51518

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)

Frequently asked questions

What is CVE-2023-51518?: CVE-2023-51518 is a critical-severity vulnerability in Apache James, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2024-02-27.
How severe is CVE-2023-51518?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2023-51518 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.