Unscored severity · published May 25, 2015
CVE-2015-0962
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers'…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Web Filter · Barracuda
7.0; 7.0.1; 7.1.0; 8.0; 8.0.002; 8.0.003 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0962
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0962
Third Party Advisory
http://www.kb.cert.org/vuls/id/534407
Vendor Advisory
https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/
Vendor Advisory
https://techlib.barracuda.com/BWF/UpdateSSLCerts
Vendor Advisory
https://www.barracuda.com/support/techalerts
More from Web Filter
–
CVE-2015-0961
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to…