Remote Code Execution (RCE) Vulnerability
52Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 44%
from disclosure to weapon0 days
Published on NVDDec 24
metasploitDec 24
VulnCheckDec 24
exploitation probability
44%top 1% of all CVEs
observed exploitation
yesVulnCheck
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.
Affected products
Barracuda Networks Inc. · Barracuda ESG ApplianceReferences
https://github.com/haile01/perl_spreadsheet_excel_rce_pochttps://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.mdhttps://metacpan.org/dist/Spreadsheet-ParseExcelhttps://www.barracuda.com/company/legal/esg-vulnerabilityhttps://www.cve.org/CVERecord?id=CVE-2023-7101