CVE-2015-2856

High

Published: 10/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

There is a directory traversal vulnerability in Accellion File Transfer Appliance devices before version FTA_9_11_210. Remote attackers can read arbitrary files by exploiting the .. (dot dot) sequence in the statecode cookie.

Risk Assessment

This vulnerability may lead to unauthorized access to sensitive data stored on the server, posing a significant security risk to the organization.

Recommendation

It is recommended to update the devices to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in Accellion File Transfer Appliance

CVE-2015-2857Critical
Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.

Original NVD description (English source)

Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackers to read arbitrary files via a .. (dot dot) in the statecode cookie.