title: Apache James server: Privilege escalation through unauthenticated JMX
description: Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a
malicious local user.
Administrators are advised to disable JMX, or set up a JMX password.
Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.
problem types: CWE-862 Missing Authorization
affected:
{
defaultStatus: unaffected
product: Apache James server
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 3.7.3, status: affected, version: 0, versionType: semver
}
metrics:
other: [
content: {'text': 'moderate'}
type: Textual description of severity
]