CVE-2023-2868

Description

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 9.4CVSS 3.1, Criticalfrom the CNA (Google)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

What to do

• Apply updates per vendor instructions.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-253 Remote Code Inclusion (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 24 May 2023 Published
2. 26 May 2023 CVE-2023-2868 added to CISA KEV
3. 26 May 2023 Added to the CISA KEV catalogue

Weakness

• CWE-20

Related coverage

• Barracuda patches ESG flaws that chain to root4 Nov 2026

References

• www.barracuda.com
• status.barracuda.com