« Volver al listado

CVE-2021-20023

Estado: AnalizadaMedia (4.9)⚠ Explotación activa

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Post-autenticado (PR:H) puede leer archivos arbitrarios (CWE-22 path traversal) en servicio remoto de correo. Impacto: acceso a datos sensibles (T1005) y potencial exposición de credenciales almacenadas (T1552).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUpdate SoftwareActive Directory ConfigurationVulnerability ScanningUser TrainingThreat Intelligence Program

Tecnologías afectadas (11)

Sonicwall — Email SecuritySonicwall — Email Security Appliance 3300 FirmwareSonicwall — Email Security Appliance 4300 FirmwareSonicwall — Email Security Appliance 5000 FirmwareSonicwall — Email Security Appliance 5050 FirmwareSonicwall — Email Security Appliance 7000 FirmwareSonicwall — Email Security Appliance 7050 FirmwareSonicwall — Email Security Appliance 8300 FirmwareSonicwall — Email Security Appliance 9000 FirmwareSonicwall — Email Security Virtual ApplianceSonicwall — Hosted Email Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-20023",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-20023",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-12T03:55:24.717669Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT@sonicwall.com",
      "affectedData": [
        {
          "vendor": "SonicWall",
          "product": "Email Security",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.9 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-20T12:15:12.587",
  "references": [
    {
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "PSIRT@sonicwall.com"
    },
    {
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20023",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "PSIRT@sonicwall.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host."
    },
    {
      "lang": "es",
      "value": "SonicWall Email Security versión 10.0.9.x, contiene una vulnerabilidad que permite a un atacante autenticado posteriormente leer un archivo arbitrario en el host remoto"
    }
  ],
  "lastModified": "2026-10-01T21:17:16.097",
  "cisaActionDue": "2021-11-17",
  "cisaExploitAdd": "2021-11-03",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EA2AE41-BCD4-4F77-8883-D201C1AFD110",
              "versionEndExcluding": "10.0.9.6173"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:email_security_appliance_9000_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A418BFA-C4E6-4473-9740-794107F86084",
              "versionEndExcluding": "10.0.9.6177"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:email_security_appliance_9000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C2434930-79AB-4AA9-AAC8-B116F3CD5CC0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:email_security_appliance_3300_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28AF18A3-3E72-400A-81A3-E0D32D550FC1",
              "versionEndExcluding": "10.0.9.6177"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:email_security_appliance_3300:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "ECF2B5A6-B62F-444E-BDB3-0084896CD83B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:email_security_appliance_4300_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "738196AF-ECBE-4AC2-914E-1DCF74DFD6A9",
              "versionEndExcluding": "10.0.9.6177"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:email_security_appliance_4300:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A18DCCAF-A373-4550-805B-EF329643B068"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:email_security_appliance_8300_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4667576A-993F-4622-B7AC-AC62DD6EFDFA",
              "versionEndExcluding": "10.0.9.6177"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:email_security_appliance_8300:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DC5803B4-57F1-4F0C-A459-F367F56AFE16"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:email_security_appliance_5000_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "848AD231-F47D-49E3-B10B-5247240191EA",
              "versionEndExcluding": "10.0.9.6177"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:email_security_appliance_5000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BA9126B7-5C64-4692-954C-6EF71261862C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:email_security_appliance_7000_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9908D0F6-1D47-4C2B-B546-3B5614EB827F",
              "versionEndExcluding": "10.0.9.6177"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:email_security_appliance_7000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A114E829-5FC6-4321-8D28-C63EC09F9099"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:email_security_appliance_5050_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD7A6C11-2167-4294-97E9-C467EE9E1B78",
              "versionEndExcluding": "10.0.9.6177"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:email_security_appliance_5050:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "271F06DD-8DAA-46EF-A803-659EA253CC63"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:email_security_appliance_7050_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6220761-AC7E-42BD-A028-CC12EE9B3430",
              "versionEndExcluding": "10.0.9.6177"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:email_security_appliance_7050:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "443B635B-6B08-479B-A635-26724B192BF0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sonicwall:email_security_virtual_appliance:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27799885-B16C-4B14-A780-54E7E20B6CB3",
              "versionEndExcluding": "10.0.9.6177"
            },
            {
              "criteria": "cpe:2.3:a:sonicwall:hosted_email_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCFC13F9-2DE3-412F-8C8B-847C81811B11",
              "versionEndExcluding": "10.0.9.6173"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "PSIRT@sonicwall.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "SonicWall Email Security Path Traversal Vulnerability"
}