CVE-2021-20247: Path Traversal
A flaw was found in mbsync before v1.3.5 and v1.4.1. mbsync doesn't validate the mailbox names returned by IMAP LIST/LSUB, which allows a malicious/compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel.
Other sources
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2021-20247.
What is the severity rating of CVE-2021-20247?
The severity rating of CVE-2021-20247 is 7.4 (high).
What software versions are affected by this vulnerability?
mbsync versions before v1.3.5 and v1.4.1 are affected by this vulnerability.
How can a malicious server exploit this vulnerability?
A malicious server can exploit this vulnerability by using specially crafted mailbox names containing '..' path components to access data outside the designated mailbox.
Are there any references available for CVE-2021-20247?
Yes, you can find references for CVE-2021-20247 at the following links: [Reference 1](https://www.openwall.com/lists/oss-security/2021/02/22/1), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1931598), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1931597).