by Kastro
Paper/Archive/CVE-2021-26293

CVE-2021-26293

mitre — An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled.

EPSS 7%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.2.942 × 2018.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refauroramail.wordpress.com/2021/02/03/addressing-dav-related-vulnerability-in-webmail-and-aurora