GCVE - cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	James (`fea3c9b3-07e6-5a9f-a7c9-815f2b2fbc84`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:apache/james`	purl2cpe	2026-06-01 10:14:33.413042
`pkg:docker/apache/james`	purl2cpe	2026-06-01 10:14:33.413046
`pkg:github/apache/james-project`	purl2cpe	2026-06-01 10:14:33.413048
`pkg:maven/org.apache.james/james-core`	purl2cpe	2026-06-01 10:14:33.413051

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-26269`	vulnerable	2026-06-08 05:57:39.003692	Apache James server: Privilege escalation through unauthenticated JMX Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users. Published: 2023-04-03T07:59:13.228Z Updated: 2025-02-13T16:44:53.250Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/2z44rg93pflbjhvbwy3xtz505bx41cbs http://www.openwall.com/lists/oss-security/2023/04/18/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-45935`	vulnerable	2026-06-08 05:50:37.588137	Apache James server: Temporary File Information Disclosure Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions. Published: 2023-01-06T09:33:30.150Z Updated: 2025-04-10T13:35:31.647Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/j61fo8xc1rxtofrn8vc33whx35s9cj1d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-28220`	vulnerable	2026-06-08 05:42:44.252050	STARTTLS command injection in Apache JAMES Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests. Published: 2022-09-08T07:40:09.000Z Updated: 2024-08-03T05:48:37.476Z Open on db.gcve.eu Reference links https://james.apache.org/james/update/2022/08/26/james-3.7.1.html http://www.openwall.com/lists/oss-security/2022/09/20/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40525`	vulnerable	2026-06-08 05:35:18.649981	Sieve file storage vulnerable to path traversal attacks Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted. Published: 2022-01-04T08:55:25.000Z Updated: 2024-08-04T02:44:10.863Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2022/01/04/4 http://www.openwall.com/lists/oss-security/2022/01/04/4 http://www.openwall.com/lists/oss-security/2022/02/07/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40111`	vulnerable	2026-06-08 05:35:16.810200	Apache James IMAP parsing Denial Of Service In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Published: 2022-01-04T08:55:24.000Z Updated: 2024-08-04T02:27:31.847Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2022/01/04/3 http://www.openwall.com/lists/oss-security/2022/01/04/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40110`	vulnerable	2026-06-08 05:35:16.809742	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-38542`	vulnerable	2026-06-08 05:33:47.832710	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.