Vulnerability · Published Sep 8, 2022 · Assigned by apache
CVE-2022-28220STARTTLS command injection in Apache JAMES
High 7.5
In plain English
A high-severity command injection in Apache James from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.0%top 18.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.james:james-server | 3.6.3 | GHSA-w45j-f5g5-w94x |
| Maven | org.apache.james:james-server | 3.7.1 | GHSA-w45j-f5g5-w94x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache James | Apache James – through 3.6.2 |
Weakness: CWE-77
References
- https://james.apache.org/james/update/2022/08/26/james-3.7.1.html x_refsource_MISC
- [oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMES mailing-list, x_refsource_MLIST