CVE-2024-21742

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache James Mime4J	<= 0.8.9

References

https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfyMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/27/5Mailing List
https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfyMailing List, Vendor Advisory

Timeline

Published: Feb 27, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-217438.8Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from CVE-2024-217445.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapster Technology Inc. Mapster WP Map CVE-2024-217455.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laybuy Laybuy Payment Extension for Wo CVE-2024-217467.5Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects CVE-2024-217474.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution w CVE-2024-217485.4Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.CVE-2024-217498.8Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au 1 click disable all.This issue affects 1 click disable all: from n/a through 1.CVE-2024-21757.8An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)CVE-2024-217506.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scribit Shortcodes Finder allows Refle CVE-2024-217518.8Missing Authorization vulnerability in RabbitLoader.This issue affects RabbitLoader: from n/a through 2.19.13.CVE-2024-217526.1Cross-Site Request Forgery (CSRF) vulnerability in Ernest Marcinko Ajax Search Lite allows Reflected XSS.This issue affects Ajax Search Lite CVE-2024-217536.0A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.