Vulnerability Details CVE-2023-7102
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.154
EPSS Ranking 94.3%
CVSS Severity
CVSS v3 Score 9.8
References
- https://github.com/haile01/perl_spreadsheet_excel_rce_poc
- https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
- https://metacpan.org/dist/Spreadsheet-ParseExcel
- https://www.barracuda.com/company/legal/esg-vulnerability
- https://www.cve.org/CVERecord?id=CVE-2023-7101
- https://github.com/haile01/perl_spreadsheet_excel_rce_poc
- https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
- https://metacpan.org/dist/Spreadsheet-ParseExcel
- https://www.barracuda.com/company/legal/esg-vulnerability
- https://www.cve.org/CVERecord?id=CVE-2023-7101
Products affected by CVE-2023-7102
-
cpe:2.3:h:barracuda:email_security_gateway_300:-
-
cpe:2.3:h:barracuda:email_security_gateway_400:-
-
cpe:2.3:h:barracuda:email_security_gateway_600:-
-
cpe:2.3:h:barracuda:email_security_gateway_800:-
-
cpe:2.3:h:barracuda:email_security_gateway_900:-
-
cpe:2.3:o:barracuda:email_security_gateway_300_firmware:5.1.3.001
-
cpe:2.3:o:barracuda:email_security_gateway_300_firmware:9.2.0.006
-
cpe:2.3:o:barracuda:email_security_gateway_400_firmware:5.1.3.001
-
cpe:2.3:o:barracuda:email_security_gateway_400_firmware:9.2.0.006
-
cpe:2.3:o:barracuda:email_security_gateway_600_firmware:5.1.3.001
-
cpe:2.3:o:barracuda:email_security_gateway_600_firmware:9.2.0.006
-
cpe:2.3:o:barracuda:email_security_gateway_800_firmware:5.1.3.001
-
cpe:2.3:o:barracuda:email_security_gateway_800_firmware:9.2.0.006
-
cpe:2.3:o:barracuda:email_security_gateway_900_firmware:5.1.3.001
-
cpe:2.3:o:barracuda:email_security_gateway_900_firmware:9.2.0.006