CVE-2015-7611: Apache James Server command injection via file-based user repositories

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated command execution with high EPSS despite no KEV listing and a High attack complexity precondition.

What it is

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands through unspecified vectors (CWE-78 OS command injection). The flaw matters because a mail server that runs attacker-supplied commands can be fully taken over, and the record gives no detail on the exact injection point, so defenders must treat any user-repository write path as suspect.

Impact

An attacker gains arbitrary command execution with the privileges of the James Server process, leading to full compromise of the host and any mail data it holds. The CVSS 3.0 vector rates confidentiality, integrity and availability impact all High.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), though attack complexity is High (AC:H), suggesting a precondition such as the file-based user repository configuration. The description does not specify the exact request path, so the precise entry point is unknown from this record.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.68603 (99.3rd percentile), indicating a high modeled likelihood of exploitation. Public Packet Storm and oss-security references describe arbitrary command execution and insecure user creation, but no reference is tagged as a working exploit.

What to do

• Upgrade Apache James Server past 2.3.2 to a release that fixes the command injection; patch first.
• If upgrade is not possible, stop using file-based user repositories and move to a repository backend that does not pass user data into system commands.
• Restrict network access to James Server administration and user-management interfaces to trusted hosts only.
• Run the James Server process under a low-privilege account with no shell access to limit command execution impact.
• Audit user repository files and creation workflows for injected content and remove any unexpected entries.

Detection

• Monitor James Server process trees for unexpected child processes such as shells or command interpreters spawned by the Java process.
• Alert on writes or modifications to file-based user repository files, especially entries containing shell metacharacters.
• Review James Server logs for user creation or repository operations that coincide with process execution events.
• Hunt for outbound network connections from the James Server host that do not match normal mail traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.