High severity7.8NVD Advisory· Published Oct 20, 2017· Updated Jun 17, 2026
CVE-2017-12628
CVE-2017-12628
Description
The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.james:james-projectMaven | < 3.0.1 | 3.0.1 |
Affected products
3- Apache Software Foundation/Apache Jamesv5Range: 3.0.0
Patches
Vulnerability mechanics
References
6- www.securityfocus.com/bid/101532nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-xj7q-q94c-6wr3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-12628ghsaADVISORY
- web.archive.org/web/20210124113233/http://www.securityfocus.com/bid/101532ghsaWEB
- www.mail-archive.com/server-user@james.apache.org/msg15633.htmlghsaWEB
- www.mail-archive.com/server-user%40james.apache.org/msg15633.htmlnvd
News mentions
0No linked articles in our index yet.