CVE-2023-7102

Published: Dec 24, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

Affected (5)

Products: Barracuda: Email Security Gateway 300 Firmware, Email Security Gateway 400 Firmware, Email Security Gateway 600 Firmware, Email Security Gateway 800 Firmware, Email Security Gateway 900 Firmware

5 products

Email Security Gateway 300 Firmware

Email Security Gateway 400 Firmware

Email Security Gateway 600 Firmware

Email Security Gateway 800 Firmware

Email Security Gateway 900 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Barracuda Email Security Gateway 300 Firmware	From 5.1.3.001 to 9.2.1.001

Running on/with	Platform Versions
Barracuda Email Security Gateway 300	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Barracuda Email Security Gateway 400 Firmware	From 5.1.3.001 to 9.2.1.001

Running on/with	Platform Versions
Barracuda Email Security Gateway 400	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Barracuda Email Security Gateway 600 Firmware	From 5.1.3.001 to 9.2.1.001

Running on/with	Platform Versions
Barracuda Email Security Gateway 600	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Barracuda Email Security Gateway 800 Firmware	From 5.1.3.001 to 9.2.1.001

Running on/with	Platform Versions
Barracuda Email Security Gateway 800	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Barracuda Email Security Gateway 900 Firmware	From 5.1.3.001 to 9.2.1.001

Running on/with	Platform Versions
Barracuda Email Security Gateway 900	All versions

Related CWEs

Use of Unmaintained Third Party Components

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

References (12)

https://github.com/haile01/perl_spreadsheet_excel_rce_poc

Source: mandiant-cve@google.com

Third Party Advisory

https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171

Source: mandiant-cve@google.com

Product

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md

Source: mandiant-cve@google.com

Third Party Advisory

https://metacpan.org/dist/Spreadsheet-ParseExcel

Source: mandiant-cve@google.com

Product

https://www.barracuda.com/company/legal/esg-vulnerability

Source: mandiant-cve@google.com

Vendor Advisory

https://www.cve.org/CVERecord?id=CVE-2023-7101

Source: mandiant-cve@google.com

Third Party Advisory

https://github.com/haile01/perl_spreadsheet_excel_rce_poc

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://metacpan.org/dist/Spreadsheet-ParseExcel

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://www.barracuda.com/company/legal/esg-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.cve.org/CVERecord?id=CVE-2023-7101

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.