An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
| Vendor | Product | Versions |
|---|---|---|
| barracuda | email security | 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| barracuda | web application | cert_advisory | 90% |
| barracuda | email security | cert_advisory | 90% |
Loading…
Added CVSS score of 9.3, updated severity to CRITICAL, marked as actively exploited, and added CWE-94 for command injection component of chained attack
Updated severity to CRITICAL, added CVSS score of 9.3, added CWE-78 for command injection vulnerability that can be chained with the auth bypass, and marked as actively exploited based on chaining capability disclosure.
Updated severity to CRITICAL with CVSS estimate of 9.0, confirmed exploit availability, refined patch version to 9.4.017+, and added 'critical' and 'root-access' tags reflecting the ability to obtain root access when combined with other vulnerabilities.
Updated affected versions from generic '0' to specific version range prior to 9.4.0.030, and added pre-authentication and authorization-bypass tags clarifying the vulnerability type.
Initial creation
