CVE-2021-20023 : SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

Published 2021-04-20 12:15:13

Updated 2022-07-14 17:04:30

Source SonicWALL, Inc.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2021-20023

Sonicwall » Email Security » For Windows
Versions before (<) 10.0.9.6173
cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:windows:*:*
Matching versions
Sonicwall » Email Security » For Email Security Virtual Appliance
Versions before (<) 10.0.9.6173
cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:email_security_virtual_appliance:*:*
Matching versions
Sonicwall » Hosted Email Security
Versions before (<) 10.0.9.6173
cpe:2.3:a:sonicwall:hosted_email_security:*:*:*:*:*:*:*:*
Matching versions

CVE-2021-20023 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

SonicWall Email Security Path Traversal Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2021-20023

Added on 2021-11-03 Action due date 2021-11-17

Exploit prediction scoring system (EPSS) score for CVE-2021-20023

EPSS FAQ

92.56%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-20023

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-20023

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Assigned by:
- nvd@nist.gov (Primary)
- PSIRT@sonicwall.com (Secondary)

References for CVE-2021-20023

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010

Security Advisory
Vendor Advisory