QID 730402

Date Published: 2022-03-16

QID 730402: SonicWall On-Premise Email Post-Authentication Arbitrary File Read Vulnerability (SNWLID-2021-0010)

SonicWall Email Security appliances and software provide multi-layered protection from inbound and outbound email threats and compliance violations by scanning all inbound and outbound email content, URLs and attachments for sensitive data, delivering real-time protection against ransomware, targeted phishing, spoofing, viruses, malicious URLs, zombies, directory harvest (DHA), Denial of Service (DoS) and other attacks.

CVE-2021-20023: SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

Affected Versions:
SonicWall On-premise Email Security (ES) 10.0.9 and earlier versions

NOTE:
CVEs are only affected for windows platform.

QID Detection Logic (Unauthenticated):
Look for affected versions by sending a get request to "login.html" endpoint.

Successful exploitation of this vulnerability may allow an remote attacker with sufficient privileges to read arbitrary file read of the target system.

CVSS V3 rated as Medium - 4.9 severity.

CVSS V2 rated as Medium - 4 severity.

Solution

The vendor has release patch and customers are requested to upgrade to 10.0.9.6173 or later. Please refer to SNWLID-2021-0010 for further information.

Vendor References

SNWLID-2021-0010 - psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010

CVEs related to QID 730402

CVE-2021-20023 |

Software Advisories

Advisory ID	Software	Component	Link
SNWLID-2021-0010			psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].