{"vulnerability": "CVE-2015-7611", "sightings": [{"uuid": "4907dd65-361c-43a6-a90c-4d897a1fd002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7611", "type": "exploited", "source": "https://www.exploit-db.com/exploits/48130", "content": "", "creation_timestamp": "2020-02-24T00:00:00.000000Z"}, {"uuid": "3fad6ab9-2820-4326-be98-ed7840c9c95c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7611", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "cacdaba3-be43-497f-9425-0b19a59d2666", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7611", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:42.000000Z"}, {"uuid": "d05dae94-54ea-4760-999d-cb40320249ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7611", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/apache_james_exec.rb", "content": "", "creation_timestamp": "2020-02-20T09:52:12.000000Z"}, {"uuid": "e7b5c0c2-2b75-48df-9ff6-58159cdf9b59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7611", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/apache_james_exec.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Palaczynski Jakub\", \"Matthew Aberegg\", \"Michael Burkey\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability that exists due to a lack of input\\n          validation when creating a user. Messages for a given user are stored\\n          in a directory partially defined by the username. By creating a user\\n          with a directory traversal payload as the username, commands can be\\n          written to a given directory. To use this module with the cron\\n          exploitation method, run the exploit using the given payload, host, and\\n          port. After running the exploit, the payload will be executed within 60\\n          seconds. Due to differences in how cron may run in certain Linux\\n          operating systems such as Ubuntu, it may be preferable to set the\\n          target to Bash Completion as the cron method may not work. If the target\\n          is set to Bash completion, start a listener using the given payload,\\n          host, and port before running the exploit. After running the exploit,\\n          the payload will be executed when a user logs into the system. For this\\n          exploitation method, bash completion must be enabled to gain code\\n          execution. This exploitation method will leave an Apache James mail\\n          object artifact in the /etc/bash_completion.d directory and the\\n          malicious user account.\", \"disclosure_date\": \"2015-10-01\", \"fullname\": \"exploit/linux/smtp/apache_james_exec\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/smtp/apache_james_exec.rb\", \"platform\": \"Linux\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"linux/smtp/apache_james_exec\", \"references\": [\"CVE-2015-7611\", \"EDB-35513\", \"URL-https://www.exploit-db.com/docs/english/40123-exploiting-apache-james-server-2.3.2.pdf\"], \"rport\": 25, \"session_types\": false, \"targets\": [\"Bash Completion\", \"Cron\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:22.397823Z"}]}