CVE-2021-26294 - CVE House
Back to Database
Status published High CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and...

Vulnerability Description

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-26294

Credits & Attribution

No credits recorded in the NVD database.

References

More from afterlogic

View All →
CVE-2021-26293
An issue was discovered in AfterLogic Aurora through 8.5.3 and...
Critical 9.8
CVE-2019-19129
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11,...
Medium 6.1
CVE-2019-16238
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged...
Medium 6.1
CVE-2017-14597
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS...
Medium 4.8
CVE-2012-2587
Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3...
Medium 4.3

Affected Vendor

Affected Software

aurora, webmail pro
Vulnerable Versions:
0

Timeline

Official Publish: March 7th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.