CVE: CVE-2022-41080 | CVSS: 9.8 | Severity: Critical
Description: CVE-2022-41080 vulnerability was discovered in MS Exchange servers 2013, 2016, and 2019. While ProxyNotShell exploit chain used CVE-2022-41040 (SSRF) vulnerability in the Autodiscover endpoint of MS Exchange, and the newfound OWASSRF exploit chain uses CVE-2022-41080 to achieve privilege escalation via MS Exchange Servers.
Barracuda Networks : Barracuda Web Application Firewall and Barracuda Web Application Firewall as a Service ( WAFaaS ) and Barracuda Load balancer ADC are not vulnerable to the said CVE.
Fix Update:
The fix will be pushed via attackdef for Barracuda Web Application Firewall and Barracuda Load Balancer ADC.
Barracuda WAF-as-a-service accounts will be updated for the definition automatically.
It is advised to watch out for false positives from this pattern and to contact Barracuda Networks Technical Support as required.