← Vulnerability feed

Vulnerability record · CVE-2023-0655 · published 14 February 2023

CVE-2023-0655: Sonicwall email security error message information leak vulnerability

Sonicwall · Email Security

SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.

5.3 CVSS 3.1 Medium EPSS 0.72% · top 47.6% CWE-209 · Error message information leak
5.3CVSS 3.1 base score
0.72%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0002 Broken Link
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0002 Broken Link

Track CVE-2023-0655 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2021-44228Apache Log4j2 JNDI lookup remote code executionApache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI …KEVEPSS 100%analysed9.8CVE-2021-20021SonicWall Email Security improper privilege management allows admin account creationSonicWall Email Security 10.0.9.x contains an improper privilege management flaw that lets an attacker create an administrative account by sending a …KEVEPSS 89%analysed9.0CVE-2021-45046Apache Log4j 2.15.0 Incomplete Fix Allows JNDI Lookup InjectionThe fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. When a non-default Pattern Layout uses a Cont…KEVEPSS 100%analysed7.2CVE-2021-20022SonicWall Email Security post-auth unrestricted file uploadSonicWall Email Security 10.0.9.x allows an authenticated attacker to upload an arbitrary file to the remote host (CWE-434). Because the upload is un…KEVEPSS 17%analysed4.9CVE-2021-20023SonicWall Email Security path traversal allows authenticated file readSonicWall Email Security 10.0.9.x contains a path traversal flaw (CWE-22) that lets an authenticated attacker read arbitrary files on the remote host…KEVEPSS 52%analysed7.4CVE-2021-3450Openssl improper certificate validation vulnerabilityThe X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Sta…EPSS 18%5.9CVE-2021-45105Apache Log4j2 uncontrolled recursion in self-referential lookups causes DoSApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) fail to protect against uncontrolled recursion from self-referential lo…EPSS 100%analysed4.8CVE-2026-3468Sonicwall email security cross-site scripting vulnerabilityA stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of use…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2023-0655), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.