Vulnerability · Published Jan 4, 2022 · Assigned by apache
CVE-2021-38542Apache James vulnerable to STARTTLS command injection (IMAP and POP3)
Medium 5.9
In plain English
A medium-severity command injection in Apache James from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)2.3%top 16.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.james:james-server | 3.6.1 | GHSA-84wg-rgp8-2hg4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache James | Apache James – before 3.6.1 |
Weakness: CWE-77
References
- https://www.openwall.com/lists/oss-security/2022/01/04/1 x_refsource_MISC
- [oss-security] 20220104 CVE-2021-38542: Apache James vulnerable to STARTTLS command injection (IMAP and POP3) mailing-list, x_refsource_MLIST
- [oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMES mailing-list, x_refsource_MLIST