CVE-2021-20023
SonicWall Email Security Path Traversal Vulnerability
Published Apr 20, 2021 · updated Oct 1, 2026 · sonicwall email security
SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 20, 2021 · Catalog
Detected
SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Oct 1, 2026 · Catalog
Updated
SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
Required action
Apply updates per vendor instructions.
CISA due date Nov 17, 2021
Affected
- cpe sonicwall/email securityversion unspecified
- cpe sonicwall/email security appliance 3300 firmwareversion unspecified
- cpe sonicwall/email security appliance 4300 firmwareversion unspecified
- cpe sonicwall/email security appliance 5000 firmwareversion unspecified
- cpe sonicwall/email security appliance 5050 firmwareversion unspecified
- cpe sonicwall/email security appliance 7000 firmwareversion unspecified
- cpe sonicwall/email security appliance 7050 firmwareversion unspecified
- cpe sonicwall/email security appliance 8300 firmwareversion unspecified
- cpe sonicwall/email security appliance 9000 firmwareversion unspecified
- cpe sonicwall/email security virtual applianceversion unspecified
- vendor SonicWall SonicWall Email Securityversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2021-20023
SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
cisa.gov - CVE.orgVulnerability recordCVE-2021-20023
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-20023
30-day exploitation probability 51.7%
first.org - NIST NVDVulnerability recordCVE-2021-20023
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
nvd.nist.gov