Actively exploited in the wild
SonicWall Email Security Path Traversal Vulnerability
SonicWall - SonicWall Email Security · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-20023
MediumCVSS 4.9KEVExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
Risk Assessment
Disclosure of sensitive data stored on the server, such as configuration files, credentials, or other confidential information.
Recommendation
Upgrade SonicWall Email Security to a patched version or apply available fixes.
Original NVD description (English source)
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.