Actively exploited in the wild
SonicWall Email Security Unrestricted Upload of File Vulnerability
SonicWall - SonicWall Email Security · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-20022
HighCVSS 7.2KEVExploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
Vulnerability in SonicWall Email Security version 10.0.9.x allows a post-authenticated attacker to upload an arbitrary file to the remote host.
Risk Assessment
Attacker could place malicious files on the server, potentially leading to further attacks.
Recommendation
Update SonicWall Email Security to a patched version.
Original NVD description (English source)
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.