IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
4.9Media KEV Usada en ransomware

CVE-2021-20023SonicWall Email Security Path Traversal Vulnerability

SonicWall Email Security Publicada: (hace 5 años)

Explotación conocida — SonicWall Email Security Path Traversal Vulnerability

CISA confirmó el 03.11.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 17.11.2021.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-20023

Descripción

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

Debilidad (CWE): CWE-22

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
SonicWall Email Security 10.0.9 and earlier
sonicwall email security appliance 3300 firmware < 10.0.9.6177
sonicwall email security appliance 4300 firmware < 10.0.9.6177
sonicwall email security appliance 5000 firmware < 10.0.9.6177
sonicwall email security appliance 5050 firmware < 10.0.9.6177
sonicwall email security appliance 7000 firmware < 10.0.9.6177
sonicwall email security appliance 7050 firmware < 10.0.9.6177
sonicwall email security appliance 8300 firmware < 10.0.9.6177
sonicwall email security appliance 9000 firmware < 10.0.9.6177
sonicwall email security virtual appliance < 10.0.9.6177
sonicwall hosted email security < 10.0.9.6173

Referencias y parches

Coincidencias CPE (NVD) (11)
  • cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:* < 10.0.9.6173
  • cpe:2.3:o:sonicwall:email_security_appliance_9000_firmware:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:o:sonicwall:email_security_appliance_3300_firmware:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:o:sonicwall:email_security_appliance_4300_firmware:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:o:sonicwall:email_security_appliance_8300_firmware:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:o:sonicwall:email_security_appliance_5000_firmware:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:o:sonicwall:email_security_appliance_7000_firmware:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:o:sonicwall:email_security_appliance_5050_firmware:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:o:sonicwall:email_security_appliance_7050_firmware:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:a:sonicwall:email_security_virtual_appliance:*:*:*:*:*:*:*:* < 10.0.9.6177
  • cpe:2.3:a:sonicwall:hosted_email_security:*:*:*:*:*:*:*:* < 10.0.9.6173

CVE recientes del mismo producto — SonicWall

5.1Media
CVE-2026-19703
SonicWall SonicOS

A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limite…

5.9Media
CVE-2026-77709
SonicWall SonicOS

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

5.9Media
CVE-2026-77708
SonicWall SonicOS

A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

7.5Alta
CVE-2026-82308
SonicWall SonicOS

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

8.8Alta
CVE-2026-107154
SonicWall SonicOS

A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.