Threats affecting pkg:maven/org.apache.james/apache-james-server

Apache James server versions prior to 3.9.1 contain a path traversal vulnerability in the SieveFileRepository component. This flaw allows authenticated attackers to set arbitrary SIEVE scripts for other users by bypassing file path validation. Exploitation can lead to denial of service or interception of mail traffic. The issue is fixed in version 3.9.1, and users are advised to upgrade.

Apache James versions prior to 3.9.1 shipped docker-compose configurations that exposed the Webadmin REST API publicly without proper authentication, creating a security risk. Starting with version 3.9.1, a random credential is set by default on unprotected webadmin endpoints to mitigate this issue while maintaining usability.

Apache James server versions 3.9.0 up to but not including 3.9.1 contain a server-side request forgery (SSRF) vulnerability in the JMAP webPush validation. This flaw allows an attacker to potentially reach internal addresses due to improper validation. The issue is fixed in version 3.9.1.

Apache James server versions 3.9.0 up to but not including 3.9.1 contain an improper access control vulnerability in the JMAP protocol. The vulnerability arises because the JMAP protocol does not properly account for negative access control rules set by the IMAP protocol, allowing users to administer folders despite explicit denial in IMAP. This issue is fixed in version 3.9.1.

Apache James versions prior to 3.9.1 contain a vulnerability in SASL OAuthBearer/XOAUTH2 authentication where the AUD claim in JWT payloads is not properly validated if introspection is not configured. This flaw allows attackers with valid credentials to gain unauthorized access to the mail server. The issue is resolved in version 3.9.1, which requires explicit configuration of AUD claims and enforces introspection.