high7.5
CVE-2021-26294
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9.
Impact
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Afterlogic | Aurora | through 7.7.9 |
| Afterlogic | Webmail Pro | through 7.7.9 |