Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAccellion File Transfer Appliance
APPAccellion≤ 9_11_200
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References
Related vulnerabilities
CVE-2019-5623CRITICAL9.8PL ✓same product
Command Injection w Accellion File Transfer Appliance (FTA_8_0_540)
CVE-2019-5622CRITICAL9.8PL ✓same product
Accellion FTA: użycie zakodowanych na stałe poświadczeń (hard-coded credentials)
CVE-2017-8794CRITICAL10.0PL ✓same product
SSRF w Accellion FTA przez błąd walidacji wyrażenia regularnego
CVE-2017-8303CRITICAL9.8PL ✓same product
RCE przez command injection w Accellion FTA — endpoint seos/1000/find.api
CVE-2017-8789CRITICAL9.8PL ✓same product
SQL Injection w Accellion FTA — parametr year w report_error.php