Known vulnerabilities in Apache James

Known vulnerabilities in Apache James

Vendor: Apache Foundation

Software: Apache James

Software CPE: cpe:2.3:a:apache_foundation:james:*:*:*:*:*:*:*:*

Website: https://www.apache.org

Total vulnerabilities: 12

Public exploits: 1

Known exploited (KEV): 0

Highest CVSSv4 Score: 8.7

Breakdown by Severity Chart

Vulnerabilities (12)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU86899 - Command injection CVE-2023-51747	CWE-77	Medium	No	No	3.7.5, 3.8.1	28.02.2024	SB2024022828
#VU86890 - Deserialization of Untrusted Data CVE-2023-51518	CWE-502	Low	No	No	3.7.5	28.02.2024	SB2024022822
#VU74278 - Missing Authorization CVE-2023-26269	CWE-862	Low	No	No	3.7.4	03.04.2023	SB2023040307
#VU70798 - Exposure of sensitive information to an unauthorized actor CVE-2022-45935	CWE-200	Low	No	No	3.7.3	09.01.2023	SB2023010908
#VU67496 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle') CVE-2022-28220	CWE-300	Medium	No	No	3.7.1	20.09.2022	SB2022092027
#VU59162 - Loop with Unreachable Exit Condition ('Infinite Loop') CVE-2021-40111	CWE-835	Medium	No	No	3.6.1	04.01.2022	SB2022010404
#VU59161 - Command injection CVE-2021-38542	CWE-77	Medium	No	No	3.6.1	04.01.2022	SB2022010404
#VU59160 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2021-40525	CWE-22	Medium	No	No	3.6.1	04.01.2022	SB2022010404
#VU59154 - Incorrect Regular Expression CVE-2021-40110	CWE-185	Low	No	No	3.6.1	04.01.2022	SB2022010404
#VU25579 - Deserialization of Untrusted Data CVE-2017-12628	CWE-502	Low	No	No	3.0.1	25.02.2020	SB2017102014
#VU25578 - Improper input validation CVE-2006-2806	CWE-20	Medium	No	No	2.3.0	25.02.2020	SB2006060501
#VU25576 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2015-7611	CWE-22	Medium	Available	No	2.3.2.1	25.02.2020	SB2016060701