by Kastro
Paper/Archive/CVE-2023-7102

CVE-2023-7102

Barracuda Networks Inc. Barracuda ESG Appliance — Remote Code Execution (RCE) Vulnerability

EPSS 45%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.8.988 × 2019.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

Affected

ProductAffectedFixed inSource
Barracuda ESG Appliance5.1.3.001 – 9.2.1.001–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbarracuda.com/company/legal/esg-vulnerabilityrefcve.org/CVERecord?id=CVE-2023-7101refmetacpan.org/dist/Spreadsheet-ParseExcelrefgithub.com/haile01/perl_spreadsheet_excel_rce_pocrefgithub.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171refgithub.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md