CVE-2008-0971
Description
Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007, Message Archiver before 1.2.1.002, Web Filter before 3.3.0.052, IM Firewall before 3.1.01.017, and Load Balancer before 2.3.024 allow remote attackers to inject arbitrary web script or HTML via (1) the Policy Name field in Search Based Retention Policy in Message Archiver; unspecified parameters in the (2) IP Configuration, (3) Administration, (4) Journal Accounts, (5) Retention Policy, and (6) GroupWise Sync components in Message Archiver; (7) input to search operations in Web Filter; and (8) input used in error messages and (9) hidden INPUT elements in (a) Spam Firewall, (b) IM Firewall, and (c) Web Filter.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| barracuda_networks barracuda_im_firewall | v ≤ 3.0.01.008 | — |
| barracuda_networks barracuda_load_balancer | v ≤ 2.2.006 | — |
| barracuda_networks barracuda_message_archiver | v ≤ 1.1.0.010 | — |
| barracuda_networks barracuda_spam_firewall | v ≤ 3.5.11.020 | — |
| barracuda_networks barracuda_web_filter | v ≤ 3.3.0.038 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.