{"schemaVersion":3,"id":"CVE-2023-51747","aliases":["GHSA-p5q9-86w4-2xr5"],"status":"published","duplicateOf":null,"title":null,"description":"Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.\n\nA lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.\n\nThe patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.\n\nWe recommend James users to upgrade to non vulnerable versions.","dates":{"published":"2024-02-27T13:08:01.807Z","modified":"2025-02-13T17:19:50.944Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.1,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","exploitability":7.2,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01045,"percentile":0.63603,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01045},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01045,"percentile":0.63603}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01045,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01045,"percentile":0.63603}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"},{"id":"CWE-290","name":"Authentication Bypass by Spoofing","description":"This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/290.html"},{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","description":"The product acts as an intermediary HTTP agent\n         (such as a proxy or firewall) in the data flow between two\n         entities such as a client and server, but it does not\n         interpret malformed HTTP requests or responses in ways that\n         are consistent with how the messages will be processed by\n         those entities that are at the ultimate destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/444.html"}],"affected":[{"vendor":"apache software foundation","product":"apache james server","name":"Apache James server","label":"apache james server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.7.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.8, ≤ 3.8.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.7.4 | ≥ 3.8, ≤ 3.8.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_james_server"},{"vendor":"apache","product":"james","name":"james","label":"james","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.7.5","noFixRecorded":false,"fixedIn":null},{"text":"3.8.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.7.5 | 3.8.1","eol":null,"hubHref":"/vendor/apache/james"},{"vendor":"org.apache.james","product":"james-server","name":"org.apache.james:james-server","label":"james-server","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.james/james-server","purlType":"maven","versions":[{"text":"< 3.7.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.8.0, < 3.8.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5 | ≥ 3.8.0, < 3.8.1","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/","label":"sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/","hostname":"sec-consult.com","tags":["Related","Product"]},{"url":"https://postfix.org/smtp-smuggling.html","label":"postfix.org/smtp-smuggling.html","hostname":"postfix.org","tags":["Related","WEB","Product"]},{"url":"https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko","label":"lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko","hostname":"lists.apache.org","tags":["Vendor Advisory","WEB","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/27/4","label":"www.openwall.com/lists/oss-security/2024/02/27/4","hostname":"www.openwall.com","tags":["WEB","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51747","label":"nvd.nist.gov/vuln/detail/CVE-2023-51747","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/james-project/commit/d1ef102540e504c067b6c1721a6f1e7eee9c6fc6","label":"github.com/apache/james-project/commit/d1ef102540e504c067b6c1721a6f1e7eee9c6fc6","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/james-project/commit/d5cd8bb098aa78d8d62c9645f3c532689ef1cb03","label":"github.com/apache/james-project/commit/d5cd8bb098aa78d8d62c9645f3c532689ef1cb03","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/james-project","label":"github.com/apache/james-project","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide","label":"sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide","hostname":"sec-consult.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-02-27T13:08:01.807Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-02-13T17:19:50.944Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":29,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:15:16.590Z","stale":false,"partial":false}}