CVE-2023-51747

Katalog CVE

CVSS 7.1 · High EPSS 1,0%

Kerentanan Improper Input Validation pada apache james. Skor CVSS 3.1 7.1 (High) menurut CISA ADP.

Deskripsi (NVD)

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions.

Rincian

Terbit di NVD

27 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-290: Authentication Bypass by Spoofing
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 63,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2024/02/27/4 mailing list · advisory pihak ketiga
• https://postfix.org/smtp-smuggling.html product
• https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ product