CVE-2016-9500

Опубликовано: 13 июл. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.

Ссылки

https://www.kb.cert.org/vuls/id/745607
Third Party Advisory
US Government Resource
https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
Exploit
Third Party Advisory
https://www.securityfocus.com/bid/96154
Third Party Advisory
VDB Entry
https://www.kb.cert.org/vuls/id/745607
Third Party Advisory
US Government Resource
https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
Exploit
Third Party Advisory
https://www.securityfocus.com/bid/96154
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:accellion:ftp_server:*:*:*:*:*:*:*:*

Версия до fta_9_12_220 (исключая)

EPSS

Процентиль: 73%

0.00745

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-80

CWE-79

Связанные уязвимости

GHSA-h4wq-vccx-g27v