Accellion FTA devices vulnerabilities
4 known CVE vulnerabilities in Accellion FTA devices, translated and rated.
- CVE-2017-8793High
An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to bypass the Same Origin Policy.
- CVE-2017-8794Critical
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to a regular expression that lacks an initial ^ character. This allows SSRF attacks with the file:///etc/passwd#https:// URL pattern.
- CVE-2017-8790Critical
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to LDAP Injection. The POST parameter 'filter' in ldaptest.html can be exploited.
- CVE-2017-8303Critical
An issue was discovered on Accellion FTA devices before FTA_9_12_180 that allows Remote Code Execution using shell metacharacters in the method parameter seos/1000/find.api.