CVE-2024-21742

Published: Feb 27, 2024Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.

Affected (1)

Products: Apache: James Mime4j

Apache

1 product

James Mime4j

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache James Mime4j	Up to 0.8.9

Related CWEs

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (3)

https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/02/27/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.