CyberSec.Space Logo
Back to CVE Browser

CVE-2017-8794

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.1520%
EPSS Percentile0.59th
PublishedMay 5, 2017
Last ModifiedMay 13, 2026

Vulnerability Description

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern.

Affected Platforms (CPE)

📦
Accellion

File Transfer Appliance

<= 9_12_40

References & Advisories

🔗 https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
🔗 https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb

Related Vulnerabilities

CVE-2015-28579.8

Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters i...

CVE-2019-56239.8

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Eleme...

CVE-2019-56229.8

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.

CVE-2016-23519.8

SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_...