high7.2Known exploited
CVE-2021-20022
SonicWall Email Security Unrestricted Upload of File Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2021-11-17.
Apply updates per vendor instructions.
Impact
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sonicwall | Email Security | before 10.0.9.6103 |
| Sonicwall | Email Security Appliance 9000 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 3300 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 4300 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 8300 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 5000 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 7000 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 5050 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 7050 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Virtual Appliance | before 10.0.9.6105 |
| Sonicwall | Hosted Email Security | before 10.0.9.6103 |