Vulnerabilities > CVE-2023-26269 - Missing Authorization vulnerability in Apache James
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 8 |