Description
Multiple vulnerabilities exist in Barracuda Networks products due to improper validation of user-controlled input. User-controllable input supplied to the embedded web server is not properly sanitized for illegal path delimiting characters prior to being used to access files. A specially crafted HTTP request containing directory traversal sequences could allow remote attackers to conduct traversal attacks.
Remediation
The vendor has released Security Definition update v2.0.4 that addresses these vulnerabilities.
References
Related Vulnerabilities
WordPress Plugin NextGEN Gallery-WordPress Gallery Local File Inclusion (2.1.56)
WordPress 4.1.x Directory Traversal (4.1 - 4.1.40)
WordPress Plugin U BuddyPress Forum Attachment 'fileurl' Parameter Remote File Disclosure (1.1.1)
WordPress Plugin BackupBuddy Arbitrary File Download (8.7.4.1)
WordPress Plugin Woocommerce-Recent Purchases Local File Inclusion (1.0.1)