PT-2021-16987
CVE-2021-26293
·
تاريخ النشر
2021-03-04
·
تاريخ التحديث
2021-03-11
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
AfterLogic Aurora versions 8.5.3 and earlier
WebMail Pro versions 8.5.3 and earlier
Description
An issue allows directory traversal to create new files, such as an executable file under the web root, when DAV is enabled. This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
Recommendations
For AfterLogic Aurora versions 8.5.3 and earlier, consider disabling DAV until a patch is available.
For WebMail Pro versions 8.5.3 and earlier, consider disabling DAV until a patch is available.
As a temporary workaround, consider restricting access to DAVServer.php and DAV/Server.php to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾