CVE-2017-12628

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.

• CWE-502

• http://www.securityfocus.com/bid/101532Third Party Advisory, VDB Entry
• https://www.mail-archive.com/server-user%40james.apache.org/msg15633.html
• http://www.securityfocus.com/bid/101532Third Party Advisory, VDB Entry
• https://www.mail-archive.com/server-user%40james.apache.org/msg15633.html

Published

Oct 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12622When an Apache Geode cluster before v1.3.0 is operating in s…
• CVE-2017-12623An authorized user could upload a template which contained m…
• CVE-2017-12624Apache CXF supports sending and receiving attachments via ei…
• CVE-2017-12625Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.…
• CVE-2017-12626Apache POI in versions prior to release 3.17 are vulnerable …7.5
• CVE-2017-12627In Apache Xerces-C XML Parser library before 3.2.1, processi…
• CVE-2017-12629Remote code execution occurs in Apache Solr before 7.1 with …9.8
• CVE-2017-12630In Apache Drill 1.11.0 and earlier when submitting form from…
• CVE-2017-12631Apache CXF Fediz ships with a number of container-specific p…
• CVE-2017-12632A malicious host header in an incoming HTTP request could ca…
• CVE-2017-12633The camel-hessian component in Apache Camel 2.x before 2.19.…
• CVE-2017-12634The camel-castor component in Apache Camel 2.x before 2.19.4…