Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAccellion Fta
APPAccellion≤ 9_12_411
CISA KEV — detailsi
- Vendori
- Accellion
- Producti
- FTA
- Added to KEVi
- November 3, 2021
- Remediation deadline (US Federal)i
- November 17, 2021(overdue)
- Ransomwarei
- Active ransomware campaigns exploit this vulnerability
Required action (CISA)i
Apply updates per vendor instructions.
CISA descriptioni
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 17 listopada 2021
Tags
Command Injection
Related vulnerabilities
CVE-2021-27101CRITICAL9.8⚠ KEVPL ✓same product
SQL injection w Accellion FTA przez nagłówek Host w żądaniu HTTP
CVE-2021-27103CRITICAL9.8⚠ KEVPL ✓same product
SSRF w Accellion FTA via wmProgressstat.html — zdalne fałszowanie żądań
CVE-2021-27104CRITICAL9.8⚠ KEVPL ✓same product
Accellion FTA — command injection przez żądanie POST do endpointów admina
CVE-2021-27730CRITICAL9.8PL ✓same product
Argument injection w Accellion FTA przez złośliwy POST request
CVE-2021-27731MEDIUM6.1same product
Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. Th...