PT-2018-5090 · Accellion+1 · Accellion Ftp Server+1

Ashish Kamble · Publicado 2018-07-13 · Atualizado 2019-10-09 · CVE-2016-9500

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Accellion FTP server versions prior to FTA 9 12 220

Description The issue concerns the use of the Accusoft Prizm Content flash component in the Accellion FTP server, which contains multiple parameters, such as customTabCategoryName and customButton1Image, that are vulnerable to cross-site scripting.

Recommendations For Accellion FTP server versions prior to FTA 9 12 220, update to version FTA 9 12 220 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters customTabCategoryName and customButton1Image to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2016-9500

Produtos afetados

Accellion Ftp Server

Accusoft Prizm Content

Referências · 5

• 🔥 https://qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2016-9500 · Aviso do Fabricante
• https://securityfocus.com/bid/96154 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9500 · Nota de Segurança
• https://kb.cert.org/vuls/id/745607 · Nota