CVE-2019-7483: high-severity vulnerability in SonicWall SMA100
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
An unauthenticated attacker can use a directory traversal flaw in SonicWall SMA100 to check whether specific files exist on the server, potentially revealing sensitive information about the system's structure.
The handleWAFRedirect CGI endpoint in SonicWall SMA100 is vulnerable to directory traversal (CWE-22) without requiring authentication. An attacker can craft malicious path parameters to traverse the directory structure and determine file existence, enabling reconnaissance for further attacks.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.