Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda…
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Barracuda
- Product
- Barracuda Email Security Gateway (ESG), Barracuda Load Balancer Application Delivery Controller (ADC), Barracuda Web Application Firewall (WAF)
- CVSS v4.0
- 8.6 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-78
- Exposure class
- Email, Edge / VPN / firewall
- NVD status
- Received
Why it ranks 37 (Notable)
- CVSS v4.0 8.6 high
- Exposed product class: email, edge / VPN / firewall
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.