CVE-2017-8303
CriticalSummary
An issue was discovered on Accellion FTA devices before FTA_9_12_180 that allows Remote Code Execution using shell metacharacters in the method parameter seos/1000/find.api.
Risk Assessment
Exploitation of this vulnerability could lead to full control over the device by an attacker, posing a serious security threat to the organization.
Recommendation
It is recommended to update Accellion FTA devices to the latest version to mitigate this vulnerability.
Other vulnerabilities in Accellion FTA devices
See all- CVE-2017-8793High
An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to bypass the Same Origin Policy.
- CVE-2017-8794Critical
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to a regular expression that lacks an initial ^ character. This allows SSRF attacks with the file:///etc/passwd#https:// URL pattern.
- CVE-2017-8790Critical
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to LDAP Injection. The POST parameter 'filter' in ldaptest.html can be exploited.
Original NVD description (English source)
An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter.