CVE-2021-26294 is a directory traversal vulnerability affecting AfterLogic Aurora and WebMail Pro versions up to 7.7.9, allowing unauthenticated attackers to read sensitive files like configuration data containing admin credentials. With a CVSS score of 7.5 (High) and an EPSS score indicating a high likelihood of exploitation, this vulnerability presents a significant risk due to its low attack complexity and severe impact on confidentiality. While there are no known active exploits or Metasploit modules, Nuclei templates exist for detection, and despite its high risk, there is currently no public community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 7.7.9CPE matchmatch criteria | cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:* | ||
<= 7.7.9CPE matchmatch criteria | cpe:2.3:a:afterlogic:webmail_pro:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.