CVE-2016-9499

Опубликовано: 13 июл. 2018

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

Ссылки

https://www.kb.cert.org/vuls/id/745607
Third Party Advisory
US Government Resource
https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
Exploit
Third Party Advisory
https://www.securityfocus.com/bid/96154
Third Party Advisory
VDB Entry
https://www.kb.cert.org/vuls/id/745607
Third Party Advisory
US Government Resource
https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
Exploit
Third Party Advisory
https://www.securityfocus.com/bid/96154
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:accellion:ftp_server:*:*:*:*:*:*:*:*

Версия до fta_9_12_220 (исключая)

EPSS

Процентиль: 66%

0.00509

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-204

CWE-200

Связанные уязвимости

GHSA-64mw-c7hp-gmxw