CVE-2008-0971: Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007, Message Archiver before 1.2.1.002, Web…

PriorityP413low3.5CVSS 2.0

AVNACMAuSCNIPAN

EPSS

1.50%

71.1th percentile

Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007, Message Archiver before 1.2.1.002, Web Filter before 3.3.0.052, IM Firewall before 3.1.01.017, and Load Balancer before 2.3.024 allow remote attackers to inject arbitrary web script or HTML via (1) the Policy Name field in Search Based Retention Policy in Message Archiver; unspecified parameters in the (2) IP Configuration, (3) Administration, (4) Journal Accounts, (5) Retention Policy, and (6) GroupWise Sync components in Message Archiver; (7) input to search operations in Web Filter; and (8) input used in error messages and (9) hidden INPUT elements in (a) Spam Firewall, (b) IM Firewall, and (c) Web Filter.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
barracuda_networks	barracuda_im_firewall	<= 3.0.01.008	—
barracuda_networks	barracuda_load_balancer	<= 2.2.006	—
barracuda_networks	barracuda_message_archiver	<= 1.1.0.010	—
barracuda_networks	barracuda_spam_firewall	<= 3.5.11.020	—
barracuda_networks	barracuda_web_filter	<= 3.3.0.038	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.