6.1Medium
CVE-2025-8319
Description
the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Barracuda | Barracuda Message Archiver | 5.4.2.002 – < 5.4.2.002 | |
| barracuda | message archiver firmware | 5.4.2.002 |
References and patches
- https://bugcrowd.com/disclosures/30a330ef-0885-458c-a64f-2ad63d196b4d/dom-based-cross-site-scripting-xss-with… ExploitIssue TrackingMitigationThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:o:barracuda:message_archiver_firmware:5.4.2.002:*:*:*:*:*:*:*