{"id":"CVE-2023-51518","aliases":["EUVD-2024-0689","GHSA-px7w-c9gw-7gj3"],"status":"published","title":"Apache James server: Privilege escalation via JMX pre-authentication deserialisation","description":"Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n - Upgrade to a non-vulnerable Apache James version\n\n - Run Apache James isolated from other processes (docker - dedicated virtual machine)\n - If possible turn off JMX","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01189,"percentile":0.68187,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2024-02-27T09:09:31Z","modified":"2026-10-28T02:31:00Z","exploits":[{"source":"pocgithub","id":"mbadanoiu/CVE-2023-51518","title":"mbadanoiu/CVE-2023-51518","date":"2024-06-03","url":"https://github.com/mbadanoiu/CVE-2023-51518"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.james:james-server","fixed_in":["3.7.5","3.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.james:james-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.7.4"},{"fixed":"3.7.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.james:james-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0"},{"fixed":"3.8.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.james:james-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5"}]}],"versions":["3.0-M1","3.0-M2","3.0-beta2","3.0-beta3","3.0-beta4","3.0.0","3.0.0-RC1","3.0.0-beta5","3.0.1","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.6.2","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.james:james-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0"},{"fixed":"3.8.1"}]}],"versions":["3.8.0"]}],"products":[{"vendor":"apache","product":"james"},{"vendor":"apache","product":"james_server"},{"vendor":"apache software foundation","product":"apache james server"}],"references":[{"url":"https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51518","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-px7w-c9gw-7gj3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51518.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-51518","title":"Apache James server: Privilege escalation via JMX pre-authentication deserialisation","description":"Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n - Upgrade to a non-vulnerable Apache James version\n\n - Run Apache James isolated from other processes (docker - dedicated virtual machine)\n - If possible turn off JMX\n\n","status":"published","published":"2024-02-27T09:09:31.579Z","modified":"2024-08-22T20:42:38.254Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:17.812395Z"}],"euvd":[{"id":"EUVD-2024-0689","description":"Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n - Upgrade to a non-vulnerable Apache James version\n\n - Run Apache James isolated from other processes (docker - dedicated virtual machine)\n - If possible turn off JMX\n\n","status":"published","published":"2024-02-27T09:09:31Z","modified":"2024-08-22T20:42:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:12.794655Z"}],"ghsa":[{"id":"GHSA-px7w-c9gw-7gj3","title":"Apache James server: Privilege escalation via JMX pre-authentication deserialization","description":"Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n - Upgrade to a non-vulnerable Apache James version\n\n - Run Apache James isolated from other processes (docker - dedicated virtual machine)\n - If possible turn off JMX\n\n","status":"published","published":"2024-02-27T09:31:16Z","modified":"2026-03-15T05:07:02Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:36.642723Z"}],"nvd":[{"id":"CVE-2023-51518","description":"Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n - Upgrade to a non-vulnerable Apache James version\n\n - Run Apache James isolated from other processes (docker - dedicated virtual machine)\n - If possible turn off JMX\n\n","status":"published","published":"2024-02-27T09:15:36.983Z","modified":"2026-06-17T06:41:07.313Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:09:07.077422Z"}],"osv":[{"id":"CVE-2023-51518","title":"Apache James server: Privilege escalation via JMX pre-authentication deserialisation","description":"Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n - Upgrade to a non-vulnerable Apache James version\n\n - Run Apache James isolated from other processes (docker - dedicated virtual machine)\n - If possible turn off JMX\n\n","status":"published","published":"2024-02-27T09:09:31.579Z","modified":"2026-10-28T02:31:00.697625526Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"GHSA-px7w-c9gw-7gj3","title":"Apache James server: Privilege escalation via JMX pre-authentication deserialization","description":"Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n - Upgrade to a non-vulnerable Apache James version\n\n - Run Apache James isolated from other processes (docker - dedicated virtual machine)\n - If possible turn off JMX\n\n","status":"published","published":"2024-02-27T09:31:16Z","modified":"2024-08-23T14:07:01.445353Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}