medium4.9Known exploited
CVE-2021-20023
SonicWall Email Security Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2021-11-17.
Apply updates per vendor instructions.
Impact
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sonicwall | Email Security | before 10.0.9.6173 |
| Sonicwall | Email Security Appliance 9000 Firmware | before 10.0.9.6177 |
| Sonicwall | Email Security Appliance 3300 Firmware | before 10.0.9.6177 |
| Sonicwall | Email Security Appliance 4300 Firmware | before 10.0.9.6177 |
| Sonicwall | Email Security Appliance 8300 Firmware | before 10.0.9.6177 |
| Sonicwall | Email Security Appliance 5000 Firmware | before 10.0.9.6177 |
| Sonicwall | Email Security Appliance 7000 Firmware | before 10.0.9.6177 |
| Sonicwall | Email Security Appliance 5050 Firmware | before 10.0.9.6177 |
| Sonicwall | Email Security Appliance 7050 Firmware | before 10.0.9.6177 |
| Sonicwall | Email Security Virtual Appliance | before 10.0.9.6177 |
| Sonicwall | Hosted Email Security | before 10.0.9.6173 |