CRITICAL🇬🇧 English

CVE-2017-8794

CVSS 10.0v3.0pub. 2017-05-05upd. 2026-05-13

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

  • Accellion File Transfer Appliance

    APP
    Accellion
    ≤ 9_12_40
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SSRF
CWE
Referencje

Powiązane podatności

CVE-2019-5623CRITICAL9.8ten sam produkt

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralizat...

CVE-2019-5622CRITICAL9.8ten sam produkt

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded C...

CVE-2015-2857CRITICAL9.8ten sam produkt

Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via sh...

CVE-2017-8789CRITICAL9.8ten sam produkt

An issue was discovered on Accellion FTA devices before FTA_9_12_180. A report_error.php?year='payload SQL inj...

CVE-2017-8303CRITICAL9.8ten sam produkt

An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Ex...