CVE-2021-20022
high · 7.2Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply updates per vendor instructions.
Added 2021-11-03Remediation due 2021-11-17
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
7.2
CVSS
16.5%
EPSS (exploit prob.)
97th
EPSS percentile
2021-04-09
Published
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sonicwall | email_security | < 10.0.9.6103 |
| microsoft | windows | all versions |
| sonicwall | email_security_appliance_9000_firmware | < 10.0.9.6105 |
| sonicwall | email_security_appliance_9000 | all versions |
| sonicwall | email_security_appliance_3300_firmware | < 10.0.9.6105 |
| sonicwall | email_security_appliance_3300 | all versions |
| sonicwall | email_security_appliance_4300_firmware | < 10.0.9.6105 |
| sonicwall | email_security_appliance_4300 | all versions |
| sonicwall | email_security_appliance_8300_firmware | < 10.0.9.6105 |
| sonicwall | email_security_appliance_8300 | all versions |
| sonicwall | email_security_appliance_5000_firmware | < 10.0.9.6105 |
| sonicwall | email_security_appliance_5000 | all versions |
| sonicwall | email_security_appliance_7000_firmware | < 10.0.9.6105 |
| sonicwall | email_security_appliance_7000 | all versions |
| sonicwall | email_security_appliance_5050_firmware | < 10.0.9.6105 |
| sonicwall | email_security_appliance_5050 | all versions |
| sonicwall | email_security_appliance_7050_firmware | < 10.0.9.6105 |
| sonicwall | email_security_appliance_7050 | all versions |
| sonicwall | email_security_virtual_appliance | < 10.0.9.6105 |
| sonicwall | hosted_email_security | < 10.0.9.6103 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-20022