|
Several Barracuda Networks products contain a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the 'cgi-mod/view_help.cgi' not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the 'locale' parameter. This directory traversal attack would allow the attacker to access arbitrary files. Successful exploitation of these vulnerabilities could lead to full remote administrative access to the vulnerable products. After obtaining administrative access, an attacker may be able to create, modify, or delete user accounts, read stored messages, purge system logs, and access sensitive and/or confidential information.
|
