{"id":"CVE-2023-7102","aliases":["EUVD-2023-59286","GHSA-ccqc-vx6w-76x6"],"status":"published","title":"Remote Code Execution (RCE) Vulnerability","description":"Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.44575,"percentile":0.98776,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-1104"],"published":"2023-12-24T21:47:20Z","modified":"2026-06-17T06:52:04Z","exploits":[{"source":"metasploit","id":"exploit/linux/smtp/barracuda_esg_spreadsheet_rce","title":"Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution","type":"exploit","platform":"Unix","date":"2023-12-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/smtp/barracuda_esg_spreadsheet_rce"}],"products":[{"vendor":"barracuda","product":"email_security_gateway_300_firmware"},{"vendor":"barracuda","product":"email_security_gateway_400_firmware"},{"vendor":"barracuda","product":"email_security_gateway_600_firmware"},{"vendor":"barracuda","product":"email_security_gateway_800_firmware"},{"vendor":"barracuda","product":"email_security_gateway_900_firmware"},{"vendor":"barracuda networks inc.","product":"barracuda esg appliance"}],"references":[{"url":"https://www.barracuda.com/company/legal/esg-vulnerability","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-7101","tags":["x_transferred","Third Party Advisory"]},{"url":"https://metacpan.org/dist/Spreadsheet-ParseExcel","tags":["x_transferred","Product"]},{"url":"https://github.com/haile01/perl_spreadsheet_excel_rce_poc","tags":["x_transferred","Third Party Advisory"]},{"url":"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171","tags":["x_transferred","Product"]},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7102"},{"url":"https://github.com/advisories/GHSA-ccqc-vx6w-76x6"}],"sources":{"cve":[{"id":"CVE-2023-7102","title":"Remote Code Execution (RCE) Vulnerability","description":"Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.\n\n","status":"published","published":"2023-12-24T21:47:20.453Z","modified":"2024-08-02T08:50:08.291Z","cwes":["CWE-1104"],"updated_at":"2026-11-02T14:35:33.794347Z"}],"euvd":[{"id":"EUVD-2023-59286","description":"Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.\n\n","status":"published","published":"2023-12-24T21:47:20Z","modified":"2024-08-02T08:50:08Z","updated_at":"2026-11-03T03:50:09.688494Z"}],"ghsa":[{"id":"GHSA-ccqc-vx6w-76x6","title":"Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG...","description":"Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.\n\n","status":"published","published":"2023-12-25T00:30:17Z","modified":"2024-01-18T05:06:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1104"],"updated_at":"2026-11-02T14:55:26.812198Z"}],"nvd":[{"id":"CVE-2023-7102","description":"Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.\n\n","status":"published","published":"2023-12-24T22:15:08.107Z","modified":"2026-06-17T06:52:04.277Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1104"],"updated_at":"2026-11-02T14:08:57.117371Z"}]}}