CVE-2017-8789
CriticalSummary
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to an SQL injection vector via report_error.php?year='payload.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the database, posing a serious threat to the confidentiality and integrity of the organization's data.
Recommendation
It is recommended to update Accellion FTA devices to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in Accellion FTA
See all- CVE-2021-27104CriticalActively exploited
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
- CVE-2021-27103CriticalActively exploited
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
- CVE-2021-27102HighActively exploited
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
- CVE-2021-27101CriticalActively exploited
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
Original NVD description (English source)
An issue was discovered on Accellion FTA devices before FTA_9_12_180. A report_error.php?year='payload SQL injection vector exists.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS