CVE-2021-38542CWE-77

Apache James vulnerable to STARTTLS command injection (IMAP and POP3)

published January 4, 2022

CVSS
—
EPSS
2%
Percentile
83.5
In the wild
Unconfirmed
What it is

Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02347 · 83.5th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2022-01-04T08:55Z
EPSS history
Timeline
  • 04 JAN 08:55Z
    Apache James vulnerable to STARTTLS command injection (IMAP and POP3)
    cvelistv5