CVE-2021-20247

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20258.2Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General).CVE-2021-202504.3A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the CVE-2021-202515.9A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if spe CVE-2021-202526.5A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date CVE-2021-202536.7A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privil CVE-2021-202546.8A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that per CVE-2021-202555.5A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while p CVE-2021-202565.3A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_h CVE-2021-202576.5An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in proc CVE-2021-202597.8A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacke CVE-2021-20268.2Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are CVE-2021-202607.8A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with