CVE-2021-20023

MediumCVSS 4.9/10Known exploited (CISA KEV)Last modified Oct 1, 2026

Description

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 20, 2021
Last modified: Oct 1, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-200248.1Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or CVE-2021-200257.8SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at ini CVE-2021-200268.8A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP r CVE-2021-200277.5A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted reques CVE-2021-200289.8Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, s CVE-2021-20035.4Vulnerability in the Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Dashboards). Sup CVE-2021-200307.5SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web directory containing CVE-2021-200316.1A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary w CVE-2021-200329.8SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which pot CVE-2021-200349.1An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete a CVE-2021-200356.5Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary co CVE-2021-200377.8SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalati