Cross site scripting

2017-05-0518:29:00

PRIOn knowledge base

www.prio-n.com

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.4%

JSON

An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads, e.g., URL encoding.

CPENameOperatorVersion
file_transfer_applianceeq<= 91240

CPE	Name	Operator	Version
	file_transfer_appliance	eq	<= 91240

References

gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb