Lucene search

[email protected]CVE-2021-20050

HistoryDec 23, 2021 - 2:15 a.m.

CVE-2021-20050

2021-12-2302:15:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2021-20050

improper access control

sma100 series

vulnerability

configuration metadata

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.9 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

50.7%

JSON

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.

CPENameOperatorVersion
sonicwall:sma_100_firmwaresonicwall sma 100 firmwarelt10.0.0.0
sonicwall:sma_100_firmwaresonicwall sma 100 firmwareeq10.2.0.8-37sv
sonicwall:sma_100_firmwaresonicwall sma 100 firmwareeq10.2.1.2-24sv
sonicwall:sma_200_firmwaresonicwall sma 200 firmwarelt10.0.0.0
sonicwall:sma_200_firmwaresonicwall sma 200 firmwareeq10.2.0.8-37sv
sonicwall:sma_200_firmwaresonicwall sma 200 firmwareeq10.2.1.2-24sv
sonicwall:sma_210_firmwaresonicwall sma 210 firmwarelt10.0.0.0
sonicwall:sma_210_firmwaresonicwall sma 210 firmwareeq10.2.0.8-37sv
sonicwall:sma_210_firmwaresonicwall sma 210 firmwareeq10.2.1.2-24sv
sonicwall:sma_400_firmwaresonicwall sma 400 firmwarelt10.0.0.0

CPE	Name	Operator	Version
sonicwall:sma_100_firmware	sonicwall sma 100 firmware	lt	10.0.0.0
sonicwall:sma_100_firmware	sonicwall sma 100 firmware	eq	10.2.0.8-37sv
sonicwall:sma_100_firmware	sonicwall sma 100 firmware	eq	10.2.1.2-24sv
sonicwall:sma_200_firmware	sonicwall sma 200 firmware	lt	10.0.0.0
sonicwall:sma_200_firmware	sonicwall sma 200 firmware	eq	10.2.0.8-37sv
sonicwall:sma_200_firmware	sonicwall sma 200 firmware	eq	10.2.1.2-24sv
sonicwall:sma_210_firmware	sonicwall sma 210 firmware	lt	10.0.0.0
sonicwall:sma_210_firmware	sonicwall sma 210 firmware	eq	10.2.0.8-37sv
sonicwall:sma_210_firmware	sonicwall sma 210 firmware	eq	10.2.1.2-24sv
sonicwall:sma_400_firmware	sonicwall sma 400 firmware	lt	10.0.0.0

Rows per page:

1-10 of 181

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0031

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.9 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

50.7%

JSON

Related for CVE-2021-20050

prion1 githubexploit1