Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
| Vendor | Product | Versions |
|---|---|---|
| barracuda | barracuda email security gateway (esg) | 0, 0, 0, 0, 0, 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| barracuda | email security | cert_advisory | 90% |
| barracuda | web application | cert_advisory | 90% |
Loading…
Article confirms HIGH severity, expands product scope to include Web Application Firewall, adds authentication bypass capability, and identifies shell command execution technique T1059.001
Updated severity to CRITICAL, expanded affected products list to include Application Delivery Controller, Load Balancer, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway, and added remote exploitation capability tag.
Initial creation
