CVE-2016-9499 The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.

2018-07-1320:00:00

CWE-204

certcc

www.cve.org

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

CNA Affected

[
  {
    "product": "FTP Server",
    "vendor": "Accellion",
    "versions": [
      {
        "lessThan": " FTA_9_12_220",
        "status": "affected",
        "version": " FTA_9_12_220",
        "versionType": "custom"
      }
    ]
  }
]