CVE-2016-9499 The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.
MediumCVSS 5.3
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| accellion ftp server | < fta_9_12_220 | fta_9_12_220 |
| accellion ftp server | >= FTA_9_12_220, < FTA_9_12_220 | FTA_9_12_220 |
References
- VU#745607 third-party-advisory us-government-resource
- www.qualys.com exploit third-party-advisory
- 96154 third-party-advisory vdb-entry