CVE-2021-20247

Katalog CVE

CVSS 7.4 · High EPSS 1,9%

Kerentanan Improper Input Validation pada mbsync project mbsync, fedoraproject extra packages for enterprise linux +2 lainnya. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

Rincian

Terbit di NVD

23 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1928963 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-15 advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2021/02/22/1 exploit · mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXQLCK35QGRC...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDEBZQJMWDW5...