Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAccellion Fta
APPAccellion< 9_12_416
CISA KEV — detailsi
- Vendori
- Accellion
- Producti
- FTA
- Added to KEVi
- November 3, 2021
- Remediation deadline (US Federal)i
- November 17, 2021(overdue)
- Ransomwarei
- Active ransomware campaigns exploit this vulnerability
Required action (CISA)i
Apply updates per vendor instructions.
CISA descriptioni
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 17 listopada 2021
Tags
SSRF
Related vulnerabilities
CVE-2021-27101CRITICAL9.8⚠ KEVPL ✓same product
SQL injection w Accellion FTA przez nagłówek Host w żądaniu HTTP
CVE-2021-27104CRITICAL9.8⚠ KEVPL ✓same product
Accellion FTA — command injection przez żądanie POST do endpointów admina
CVE-2021-27730CRITICAL9.8PL ✓same product
Argument injection w Accellion FTA przez złośliwy POST request
CVE-2021-27102HIGH7.8⚠ KEVsame product
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed...
CVE-2021-27731MEDIUM6.1same product
Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. Th...