Apache James Server vulnerabilities

4 CVEs affecting Apache James Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-45626, published 2025-02-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7611, published 2016-06-07. High severity, CVSS 8.1. EPSS: 68.6% chance of exploitation in the next 30 days. Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
CVE-2024-37358, published 2025-02-06. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause…
CVE-2024-45626, published 2025-02-06. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended…
CVE-2017-12628, published 2017-10-20. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX…