CVE-2022-2324 : Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture AT

Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. This vulnerability impacts 10.0.17.7319 and earlier versions

Published 2022-07-29 21:15:10

Updated 2022-08-08 18:07:46

Source SonicWALL, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-2324

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-2324

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2022-2324

CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Assigned by: nvd@nist.gov (Primary)

CWE-358 Improperly Implemented Security Check for Standard

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

Assigned by: PSIRT@sonicwall.com (Secondary)

Products affected by CVE-2022-2324

Sonicwall » Email Security
Versions up to, including, (<=) 10.0.17.7319
cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-2324

Exploit prediction scoring system (EPSS) score for CVE-2022-2324

CVSS scores for CVE-2022-2324

CWE ids for CVE-2022-2324

References for CVE-2022-2324

Products affected by CVE-2022-2324