CVE-2021-20023: medium-severity vulnerability in SonicWall Email Security
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
SonicWall Email Security versions 10.0.9.x contain a flaw that allows someone already logged into the system to read any file on the server. This is dangerous because attackers with access can steal sensitive configuration files or data.
Path traversal vulnerability (CWE-22) in SonicWall Email Security 10.0.9.x enables post-authenticated arbitrary file read via improper input validation. An attacker with valid credentials can bypass directory restrictions and access unauthorized files on the host system, potentially exposing sensitive configuration data or credentials.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.