Skip to main content

Improper Input Validation

CVE-2023-51747

High
7.1/10

Summary

Apache James is vulnerable to SMTP smuggling. A lenient behavior in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelope, allowing for instance to bypass SPF checks. The patch implies the enforcement of CRLF as a line delimiter as part of the DATA transaction. This affects versions 3.0.0-beta5 through 3.7.4 and 3.8.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published