CVE-2021-26294
HIGH
7.5
CVSS Severity Score
Vulnerability Description
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).
Affected Platforms (CPE)
📦
Afterlogic
Aurora
<= 7.7.9📦
Afterlogic