CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9

published March 7, 2021

CVSS
—
EPSS
17%
Percentile
97.0
In the wild
Unconfirmed
What it is

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.16899 · 97.0th percentile
Published
2021-03-07T03:42Z
EPSS history
Timeline
  • 07 MAR 03:42Z
    An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9
    cvelistv5