CVE-2023-7102

🗓️ 24 Dec 2023 21:47:20Reported by MandiantType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 218 Views

Use of Third Party library caused Parameter Injection vulnerability in Barracuda ESG Applianc

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2023-7102	24 Dec 202322:15	–	attackerkb
Circl	CVE-2023-7102	24 Dec 202323:26	–	circl
CNNVD	Barracuda Email Security Gateway Security Vulnerability	24 Dec 202300:00	–	cnnvd
Cvelist	CVE-2023-7102 Remote Code Execution (RCE) Vulnerability	24 Dec 202321:47	–	cvelist
Hive Pro Threat Advisories	Barracuda Fixes ACE Zero-day Vulnerability Exploited by Attackers	29 Dec 202304:05	–	hivepro
Metasploit	Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution	19 May 202619:00	–	metasploit
NVD	CVE-2023-7102	24 Dec 202322:15	–	nvd
Packet Storm	📄 Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution	20 May 202600:00	–	packetstorm
Prion	Design/Logic Flaw	24 Dec 202322:15	–	prion
Positive Technologies	PT-2023-8145	21 Dec 202300:00	–	ptsecurity

NVD

Node

barracuda email_security_gateway_300_firmwareRange5.1.3.001–9.2.1.001

AND

barracuda email_security_gateway_300Match-

Node

barracuda email_security_gateway_400_firmwareRange5.1.3.001–9.2.1.001

AND

barracuda email_security_gateway_400Match-

Node

barracuda email_security_gateway_600_firmwareRange5.1.3.001–9.2.1.001

AND

barracuda email_security_gateway_600Match-

Node

barracuda email_security_gateway_800_firmwareRange5.1.3.001–9.2.1.001

AND

barracuda email_security_gateway_800Match-

Node

barracuda email_security_gateway_900_firmwareRange5.1.3.001–9.2.1.001

AND

barracuda email_security_gateway_900Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "Barracuda ESG Appliance",
    "vendor": "Barracuda Networks Inc.",
    "versions": [
      {
        "changes": [
          {
            "at": "Patched in all active versions by security update removing the vulnerable logic.",
            "status": "affected"
          }
        ],
        "lessThanOrEqual": "9.2.1.001",
        "status": "affected",
        "version": "5.1.3.001",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/haile01/perl_spreadsheet_excel_rce_poc
cve	www.cve.org/CVERecord
github	www.github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
barracuda	www.barracuda.com/company/legal/esg-vulnerability
github	www.github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm
metacpan	www.metacpan.org/dist/Spreadsheet-ParseExcel

21 Nov 2024 08:45Current

9.4High risk

Vulners AI Score9.4

CVSS 3.19.8

EPSS0.82719