PT-2017-18529 · Accellion · Accellion Fta

Publicado 2017-05-05 · Atualizado 2017-05-17 · CVE-2017-8789

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180

Description A SQL injection issue exists due to a report error.php API endpoint that is vulnerable to injection attacks. The year parameter is specifically mentioned as a vector for this injection. This could potentially allow an attacker to execute unauthorized SQL commands.

Recommendations For versions prior to FTA 9 12 180, update to FTA 9 12 180 or later to resolve the issue. As a temporary workaround, consider restricting access to the report error.php API endpoint to minimize the risk of exploitation. Avoid using the year parameter in the report error.php endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-8789

Produtos afetados

Accellion Fta

Referências · 3

• 🔥 https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8789 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8789 · Aviso do Fabricante