Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAccellion Fta
APPAccellion≤ 9_12_370
CISA KEV — szczegółyi
- Dostawcai
- Accellion
- Produkti
- FTA
- Data dodania do KEVi
- 3 listopada 2021
- Termin remediation (USA)i
- 17 listopada 2021(po terminie)
- Ransomwarei
- Aktywne kampanie ransomware używają tej podatności
Zastosuj aktualizacje zgodnie z instrukcjami dostawcy.
▸ Pokaż oryginał (EN)
Apply updates per vendor instructions.
Accellion FTA zawiera lukę SQL injection wykorzystywaną poprzez spreparowany nagłówek host w żądaniu do document_root.html.
▸ Pokaż oryginał (EN)
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
Powiązane podatności
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The ...
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various a...
Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin en...
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed...
Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. Th...