high8.1Public exploit code
CVE-2015-7611
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache James Server 2.3.2 - Insecure User Creation Arbitrary File Write (Metasploit)2020-02-24 · remote · linux · Verified
Impact
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | James Server | Version 2.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/133798/Apache-James-Server-2.3.2-Arbitrary-Command-Execution.html
- http://packetstormsecurity.com/files/156463/Apache-James-Server-2.3.2-Insecure-User-Creation-Arbitrary-File-Write.html
- http://www.openwall.com/lists/oss-security/2015/09/30/7
- http://www.openwall.com/lists/oss-security/2015/10/01/2
- http://www.securityfocus.com/archive/1/536575/100/0/threaded
- https://blogs.apache.org/james/entry/apache_james_server_2_3
- http://packetstormsecurity.com/files/133798/Apache-James-Server-2.3.2-Arbitrary-Command-Execution.html
- http://packetstormsecurity.com/files/156463/Apache-James-Server-2.3.2-Insecure-User-Creation-Arbitrary-File-Write.html
- http://www.openwall.com/lists/oss-security/2015/09/30/7
- http://www.openwall.com/lists/oss-security/2015/10/01/2
- http://www.securityfocus.com/archive/1/536575/100/0/threaded
- https://blogs.apache.org/james/entry/apache_james_server_2_3