CVE-2021-20022

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Oct 1, 2026

Description

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2021
Last modified
Oct 1, 2026
Added to CISA KEV
Nov 3, 2021
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-200234.9SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on thCVE-2021-200248.1Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability orCVE-2021-200257.8SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at iniCVE-2021-200268.8A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP rCVE-2021-200277.5A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted requesCVE-2021-200289.8Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, sCVE-2021-20035.4Vulnerability in the Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Dashboards). SupCVE-2021-200307.5SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web directory containingCVE-2021-200316.1A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary wCVE-2021-200329.8SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potCVE-2021-200349.1An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete aCVE-2021-200356.5Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary co