High severity · published Oct 13, 2022
CVE-2021-20030
SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web directory containing application's binaries and…
7.5
CVSS
1%
EPSS
No
On KEV
Description
SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web directory containing application's binaries and configuration files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
SonicWall GMS · SonicWall
prior GMS 9.3.2 · source: vendor
GM
Global Management System · Sonicwall
before 9.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20030
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20030
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0021
More from SonicWall GMS
9.8
CVE-2022-22280
Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.3.1-SP2-Hotfix1, Analytics…