CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2021-27101

CVSS 9.8v3.1pub. 2021-02-16upd. 2025-11-03

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Accellion Fta

    APP
    Accellion
    ≤ 9_12_370

CISA KEV — detailsi

Vendori
Accellion
Producti
FTA
Added to KEVi
November 3, 2021
Remediation deadline (US Federal)i
November 17, 2021(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 17 listopada 2021
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2021-27103CRITICAL9.8⚠ KEVPL ✓same product

SSRF w Accellion FTA via wmProgressstat.html — zdalne fałszowanie żądań

CVE-2021-27104CRITICAL9.8⚠ KEVPL ✓same product

Accellion FTA — command injection przez żądanie POST do endpointów admina

CVE-2021-27730CRITICAL9.8PL ✓same product

Argument injection w Accellion FTA przez złośliwy POST request

CVE-2021-27102HIGH7.8⚠ KEVsame product

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed...

CVE-2021-27731MEDIUM6.1same product

Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. Th...