CVE-2021-20023
medium · 4.9Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply updates per vendor instructions.
Added 2021-11-03Remediation due 2021-11-17
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
4.9
CVSS
51.4%
EPSS (exploit prob.)
99th
EPSS percentile
2021-04-20
Published
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sonicwall | email_security | < 10.0.9.6173 |
| microsoft | windows | all versions |
| sonicwall | email_security_appliance_9000_firmware | < 10.0.9.6177 |
| sonicwall | email_security_appliance_9000 | all versions |
| sonicwall | email_security_appliance_3300_firmware | < 10.0.9.6177 |
| sonicwall | email_security_appliance_3300 | all versions |
| sonicwall | email_security_appliance_4300_firmware | < 10.0.9.6177 |
| sonicwall | email_security_appliance_4300 | all versions |
| sonicwall | email_security_appliance_8300_firmware | < 10.0.9.6177 |
| sonicwall | email_security_appliance_8300 | all versions |
| sonicwall | email_security_appliance_5000_firmware | < 10.0.9.6177 |
| sonicwall | email_security_appliance_5000 | all versions |
| sonicwall | email_security_appliance_7000_firmware | < 10.0.9.6177 |
| sonicwall | email_security_appliance_7000 | all versions |
| sonicwall | email_security_appliance_5050_firmware | < 10.0.9.6177 |
| sonicwall | email_security_appliance_5050 | all versions |
| sonicwall | email_security_appliance_7050_firmware | < 10.0.9.6177 |
| sonicwall | email_security_appliance_7050 | all versions |
| sonicwall | email_security_virtual_appliance | < 10.0.9.6177 |
| sonicwall | hosted_email_security | < 10.0.9.6173 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-20023