← Back

CVE-2021-20021

nvd nistnuclei
Published: Apr 9, 2021Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

Affected (11)

Sonicwall
11 products
Email Security
Email Security Appliance 9000 Firmware
Email Security Appliance 3300 Firmware
Email Security Appliance 4300 Firmware
Email Security Appliance 8300 Firmware
Email Security Appliance 5000 Firmware
Email Security Appliance 7000 Firmware
Email Security Appliance 5050 Firmware
Email Security Appliance 7050 Firmware
Email Security Virtual Appliance
Hosted Email Security
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security
Before 10.0.9.6103
Running on/withPlatform Versions
Microsoft
Windows
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 9000 Firmware
Before 10.0.9.6105
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 9000
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 3300 Firmware
Before 10.0.9.6105
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 3300
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 4300 Firmware
Before 10.0.9.6105
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 4300
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 8300 Firmware
Before 10.0.9.6105
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 8300
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 5000 Firmware
Before 10.0.9.6105
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 5000
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 7000 Firmware
Before 10.0.9.6105
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 7000
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 5050 Firmware
Before 10.0.9.6105
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 5050
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 7050 Firmware
Before 10.0.9.6105
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 7050
All versions
Configuration J
2 vulnerable
Vulnerable SoftwareAffected Versions
Email Security Virtual Appliance
Before 10.0.9.6105
Hosted Email Security
Before 10.0.9.6103

Related CWEs

CWE-269
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (3)

Source: PSIRT@sonicwall.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.