← Back

CVE-2021-20023

nvd nist
Published: Apr 20, 2021Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
4.9
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.2 / Impact: 3.6
Source: NVD

Description

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

Affected (11)

Sonicwall
11 products
Email Security
Email Security Appliance 9000 Firmware
Email Security Appliance 3300 Firmware
Email Security Appliance 4300 Firmware
Email Security Appliance 8300 Firmware
Email Security Appliance 5000 Firmware
Email Security Appliance 7000 Firmware
Email Security Appliance 5050 Firmware
Email Security Appliance 7050 Firmware
Email Security Virtual Appliance
Hosted Email Security
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security
Before 10.0.9.6173
Running on/withPlatform Versions
Microsoft
Windows
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 9000 Firmware
Before 10.0.9.6177
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 9000
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 3300 Firmware
Before 10.0.9.6177
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 3300
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 4300 Firmware
Before 10.0.9.6177
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 4300
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 8300 Firmware
Before 10.0.9.6177
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 8300
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 5000 Firmware
Before 10.0.9.6177
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 5000
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 7000 Firmware
Before 10.0.9.6177
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 7000
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 5050 Firmware
Before 10.0.9.6177
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 5050
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Email Security Appliance 7050 Firmware
Before 10.0.9.6177
Running on/withPlatform Versions
Sonicwall
Email Security Appliance 7050
All versions
Configuration J
2 vulnerable
Vulnerable SoftwareAffected Versions
Email Security Virtual Appliance
Before 10.0.9.6177
Hosted Email Security
Before 10.0.9.6173

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

Source: PSIRT@sonicwall.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.