CVE-2023-51518: Apache James server Privilege Escalation via JMX Pre-Authentication Deserialization
Summary
CVE-2023-51518: Apache James server: Privilege escalation via JMX pre-authentication deserialization. Affects org.apache.james:james-server across 2 version ranges.
< 3.7.5
>= 3.8.0, < 3.8.1
Fixed in 3.7.5 or 3.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache James is an open-source email server that provides a platform for sending, receiving, and managing email messages. It is written in Java and offers various features for email communication. However, versions prior to 3.7.5 and 3.8.0 of Apache James server are vulnerable to a privilege escalation attack through the JMX endpoint. This endpoint, which is bound locally by default, allows for pre-authentication deserialization of untrusted data.
Vulnerability Detail
The vulnerability in Apache James server arises from the ability to deserialize untrusted data without proper authentication. An attacker can exploit this vulnerability by providing a malicious deserialization gadget, which can be part of an exploit chain leading to privilege escalation. By leveraging this vulnerability, an attacker could gain unauthorized access and perform actions with elevated privileges. It is important to note that the JMX endpoint is only bound locally by default, limiting the potential attack surface.
How To Fix
Latest published version: 3.9.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.7.53.7.5 -
>= 3.8.0, < 3.8.13.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to disable the JMX endpoint in Apache James server. This can be achieved by modifying the server configuration to prevent the JMX service from starting. However, it is important to note that this workaround may impact the functionality of certain monitoring or management tools that rely on JMX.
Conclusion
The vulnerability in Apache James server allows for privilege escalation through the JMX pre-authentication deserialization. To mitigate the risk, it is crucial to upgrade to a non-vulnerable version, isolate the server, and consider disabling the JMX endpoint. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.james:james-server →
FAQ
Apache James server is an open-source email server written in Java that provides email communication capabilities.
Versions prior to 3.7.5 and 3.8.0 of Apache James server are affected by this vulnerability.
This vulnerability can be exploited by an attacker to escalate privileges and gain unauthorized access to the Apache James server.
Yes, the JMX endpoint is enabled by default in Apache James server, but it is only bound locally.
Upgrading to a non-vulnerable version of Apache James server, running the server in isolation, and disabling the JMX endpoint are recommended mitigations.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.james:james-server.
