CVE-2023-7102

Remote Code Execution (RCE) Vulnerability

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

Affected

Barracuda Networks Inc. · Barracuda ESG Appliance

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

44.57% chance of exploitation in the next 30 days, 99th percentile

Published

2023-12-24

Updated

2024-08-02

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/barracuda_esg_spreads…

Security advisories

• https://www.barracuda.com/company/legal/esg-vulnerability
• haile01/perl_spreadsheet_excel_rce_poc
• mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
• https://www.cve.org/CVERecord?id=CVE-2023-7101
• jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spread…
• https://metacpan.org/dist/Spreadsheet-ParseExcel

References

• CVE Record
• NVD entry