CVE-2023-7102 is a critical parameter injection vulnerability (CVSS 9.8) in Barracuda Email Security Gateway (ESG) appliances, affecting versions 5.1.3.001 through 9.2.1.001. This flaw, stemming from a third-party library, allows unauthenticated remote attackers to achieve high impact on confidentiality, integrity, and availability. It has been actively exploited as a zero-day by Chinese threat actors, targeting government and tech organizations, despite no public exploit code being available. The high community discussion and media coverage highlight its significant real-world impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.1.3.001, <= 9.2.1.001CPE matchmatch criteria | cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:* | ||
>= 5.1.3.001, <= 9.2.1.001CPE matchmatch criteria | cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:* | ||
>= 5.1.3.001, <= 9.2.1.001CPE matchmatch criteria | cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:* | ||
>= 5.1.3.001, <= 9.2.1.001CPE matchmatch criteria | cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:* | ||
>= 5.1.3.001, <= 9.2.1.001CPE matchmatch criteria | cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.