CVE-2015-7611: apache james_server OS Command Injection
Vulnerability summary
CVE-2015-7611 is a high (CVSS 9.3) OS Command Injection vulnerability in apache james_server. EPSS estimates a 68.60% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 07-06-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
68.60%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 68.60% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundApache James Server 2.3.2 - Insecure User Creation Arbitrary File Write (Metasploit)
Maturity: weaponized
Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write
exploit/linux/smtp/apache_james_exec
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Apache1 product
- james_server2.3.2
Org.apache.james1 product
- james-server< 2.3.2.1
2 vendors · 2 products
