CVE-2019-7483

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
SonicWall	SMA100	9.0.0.3 and earlier

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0018Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0018Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7483US Government Resource

Timeline

Published: Dec 19, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 28, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-74846.5Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script. T CVE-2019-74858.8Buffer overflow in SonicWall SMA100 allows an authenticated user to execute arbitrary code in DEARegister CGI script. This vulnerability imp CVE-2019-74868.8Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impac CVE-2019-74877.8Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes CVE-2019-74889.8Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database. T CVE-2019-74899.8A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. This vulnerability aff CVE-2019-75247.8In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can b CVE-2019-75355.3index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path discl CVE-2019-75379.8An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Pyth CVE-2019-75398.8A code injection issue was discovered in ipycache through 2016-05-31.CVE-2019-75416.1Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.CVE-2019-75436.1In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.