CVE-2018-20369

Name of the Vulnerable Software and Affected Versions Barracuda Message Archiver version 2018

Description The issue concerns an XSS vulnerability in the error msg exception-handling value for the ldap user parameter to the cgi-mod/ldap load entry.cgi module. The injection point of the issue is the Add Update module.

Recommendations For Barracuda Message Archiver version 2018, consider restricting access to the cgi-mod/ldap load entry.cgi module until a fix is available, and avoid using the ldap user parameter in this module to minimize the risk of exploitation.