GitHub Advisoryadvisory · Maven

GHSA-jw7r-rxff-gv24 Apache James MIME4J improper input validation vulnerability

MEDIUM Published 2024-02-27 Modified 2025-02-14 Official page ↗
Aliases
CVE-2024-21742
Ecosystem
Maven
Packages
org.apache.james:apache-mime4j-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20, CWE-74
Reviewed
2024-02-27

Affected packages

• Maven org.apache.james:apache-mime4j-core: < 0.8.10 → fixed in 0.8.10

Description

Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.

Related

Alias · CVE (1)

  • CVE-2024-21742 Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References