CVE-2017-8794
CriticalSummary
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to a regular expression that lacks an initial ^ character. This allows SSRF attacks with the file:///etc/passwd#https:// URL pattern.
Risk Assessment
An attacker could exploit this vulnerability to access sensitive files on the server, potentially leading to data exposure or further attacks on the organization's infrastructure.
Recommendation
It is recommended to update Accellion FTA devices to version FTA_9_12_180 or later to mitigate this vulnerability.
Original NVD description (English source)
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern.