SonicWall Email Security Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the SonicWall Email Security appliance. This issue arises from improper neutralization of user-supplied input during web page generation, which allows remote authenticated attackers with admin privileges to execute arbitrary JavaScript code. The vulnerability affects SonicWall Email Security versions 10.0.34.8215, 10.0.34.8223, and earlier.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user.

Remediation

Users are advised to upgrade to SonicWall Email Security version 10.0.35.8405 or higher. For those using VMWare or Hyper-V, the same version should be applied.