CVE-2015-7611 Apache James Server OS Command Injection

What is CVE-2015-7611?

CVE-2015-7611 is a high-severity command injection vulnerability in n/a, published on 7 Jun 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

Weakness: CWE-78

Which versions are affected by CVE-2015-7611?

2 open source packages ship an affected version, including org.apache.james:james-server. It affects 1 product.

Products include Apache James Server.

How do I fix CVE-2015-7611?

Upgrade org.apache.james:james-server to 2.3.2.1 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2015-7611 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-7611 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2024-37358 Apache James: denial of service through the use of IMAP literals High 8.6
• CVE-2017-12628 Apache James Privilege Escalation High 7.8
• CVE-2024-45626 Apache James: denial of service through JMAP HTML to text conversion Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cgvf-22vv-83h5.