VulnerabilityModified
CVE-2015-0961
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
MEDIUM 4.3EPSS 0.76%
Does this matter?
Lower severity and a low EPSS score (0.76%). Track it; it rarely justifies an emergency change on its own.
Description
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 0.76% probability · 53th percentile
- CISA KEV
- Not listed
- Affected
- barracuda/web filter
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/534407Third Party Advisory, US Government Resource
- https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/Vendor Advisory
- https://techlib.barracuda.com/BWF/UpdateSSLCertsVendor Advisory
- https://www.barracuda.com/support/techalertsVendor Advisory
- http://www.kb.cert.org/vuls/id/534407Third Party Advisory, US Government Resource
- https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/Vendor Advisory
- https://techlib.barracuda.com/BWF/UpdateSSLCertsVendor Advisory
- https://www.barracuda.com/support/techalertsVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.