Riskcovery

CVE-2023-51747

SMTP smuggling in Apache James

State
Published
Severity
7.1 High
Published
Feb 27, 2024
Updated
Feb 13, 2025
Reserved
Dec 22, 2023

Read the record on cve.org

Description

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.

A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.

The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.

We recommend James users to upgrade to non vulnerable versions.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NCISA-ADP

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
  • CWE-290 Authentication Bypass by Spoofing

Affected Products

ProductVersions
Apache James serverApache Software Foundation
  • 3.7.4 and earlierAffected
  • 3.8 through 3.8.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.