CVE-2023-2868

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 87,7%

Kerentanan Improper Input Validation pada barracuda email security gateway 300 firmware, barracuda email security gateway 400 firmware +3 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 26 Mei 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Rincian

Terbit di NVD

24 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

87,7% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

Masuk KEV

26 Mei 2023

Tenggat CISA

16 Juni 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://status.barracuda.com/incidents/34kx82j5n4q9 advisory vendor
• https://www.barracuda.com/company/legal/esg-vulnerability mitigasi · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868 pemerintah AS