CVE-2021-20022: high-severity vulnerability in SonicWall Email Security
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
56Vexday Risk Score
Prioritize patching. It under exploitation confirmed by CISA.
ssvc Actcvss 7.2epss 17%
from disclosure to weapon
Published on NVDApr 9
CISA KEV+208d
Action required by CISAfederal deadline: 2021-11-17
Apply updates per vendor instructions.
In short
A flaw in SonicWall Email Security 10.0.9.x allows an authenticated user to upload any file to the server, potentially installing malware or gaining control of the system.
Technical detail
Post-authentication arbitrary file upload vulnerability in SonicWall Email Security 10.0.9.x due to insufficient file validation. An authenticated attacker can exploit this to upload malicious files (CWE-434), leading to remote code execution or system compromise.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
SonicWall · Email SecurityRelated CVEs — SonicWall Email Security
In the same product, most dangerous first.