What is CVE-2021-20023?

CVE-2021-20023 is a path traversal vulnerability in SonicWall Email Security that allows an authenticated attacker to read files on the remote host.

How severe is CVE-2021-20023?

CVE-2021-20023 has a severity rating of 4.9 out of 10, which is considered medium.

Who is affected by CVE-2021-20023?

SonicWall Email Security versions up to 10.0.9.6173, SonicWall Email Security Virtual Appliance, Sonicwall Email Security for Windows, and Sonicwall Hosted Email Security versions up to 10.0.9.6173 are affected by CVE-2021-20023.

How can an attacker exploit CVE-2021-20023?

An attacker with post-authentication can exploit CVE-2021-20023 to read files on the remote host, especially when combined with CVE-2021-20021 and CVE-2021-20022 for privilege escalation.

Is there a fix for CVE-2021-20023?

To fix CVE-2021-20023, users should update to SonicWall Email Security version 10.0.9.6173 or higher.

Vulnerability/
CVE-2021-20023

Exploited

medium

4.9

CWE

20/4/2021

14/7/2022

CVE-2021-20023: SonicWall Email Security Path Traversal Vulnerability

First published: Tue Apr 20 2021(Updated: )

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

Credit: PSIRT@sonicwall.com

Affected Software	Affected Version	How to fix
Sonicwall Email Security	<10.0.9.6173
Sonicwall Email Security	<10.0.9.6173
Sonicwall Hosted Email Security	<10.0.9.6173

Never miss a vulnerability like this again

Reference Links

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010

Frequently Asked Questions

What is CVE-2021-20023?
CVE-2021-20023 is a path traversal vulnerability in SonicWall Email Security that allows an authenticated attacker to read files on the remote host.
How severe is CVE-2021-20023?
CVE-2021-20023 has a severity rating of 4.9 out of 10, which is considered medium.
Who is affected by CVE-2021-20023?
SonicWall Email Security versions up to 10.0.9.6173, SonicWall Email Security Virtual Appliance, Sonicwall Email Security for Windows, and Sonicwall Hosted Email Security versions up to 10.0.9.6173 are affected by CVE-2021-20023.
How can an attacker exploit CVE-2021-20023?
An attacker with post-authentication can exploit CVE-2021-20023 to read files on the remote host, especially when combined with CVE-2021-20021 and CVE-2021-20022 for privilege escalation.
Is there a fix for CVE-2021-20023?
To fix CVE-2021-20023, users should update to SonicWall Email Security version 10.0.9.6173 or higher.

agent/author
agent/description
agent/event
agent/first-publish-date
agent/last-modified-date
agent/references
agent/severity
agent/softwarecombine
agent/tags
agent/title
agent/type
agent/weakness
exploited/true
ransomware/true
collector/cisa-known-exploited
source/CISA
agent/software-canonical-lookup
collector/nvd-index
vendor/sonicwall
canonical/sonicwall sonicwall email security
canonical/sonicwall email security
canonical/sonicwall hosted email security

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.