PT-2018-5090 · Accellion+1 · Accellion Ftp Server+1

Ashish Kamble · Published 2018-07-13 · Updated 2019-10-09 · CVE-2016-9500

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Accellion FTP server versions prior to FTA 9 12 220

Description The issue concerns the use of the Accusoft Prizm Content flash component in the Accellion FTP server, which contains multiple parameters, such as customTabCategoryName and customButton1Image, that are vulnerable to cross-site scripting.

Recommendations For Accellion FTP server versions prior to FTA 9 12 220, update to version FTA 9 12 220 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters customTabCategoryName and customButton1Image to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2016-9500

Affected Products

Accellion Ftp Server

Accusoft Prizm Content

References · 5

• 🔥 https://qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2016-9500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9500 · Security Note
• https://securityfocus.com/bid/96154 · Note
• https://kb.cert.org/vuls/id/745607 · Note