Relative Path Traversal Vulnerability in SonicWall SMA Appliances
CVE-2021-20040

7.5HIGH

Key Information:

Vendor
Sonicwall
Status
Sonicwall Sma100
Vendor
CVE Published:
8 December 2021

Summary

A security vulnerability exists in the SMA100 upload function that allows remote unauthenticated attackers to exploit relative path traversal. This flaw enables attackers to upload malicious web pages or files with the privileges of the 'nobody' user. It primarily impacts SonicWall SMA 200, 210, 400, 410, and 500v appliances, posing a significant risk to system integrity.

Affected Version(s)

SonicWall SMA100 10.2.0.8-37sv and earlier

SonicWall SMA100 10.2.1.1-19sv and earlier

SonicWall SMA100 10.2.1.2-24sv and earlier

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.