1. Home
  2. CVE Database
  3. CVE-2017-8760
MEDIUM · 6.1

CVE-2017-8760

An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries to use internal WAF filters to stop spec...

Vulnerability Description

An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads, e.g., URL encoding.

CVSS Score

6.1

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
AccellionFile Transfer Appliance<= 9_12_40

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2017-8760?

CVE-2017-8760 is a vulnerability with a CVSS score of 6.1 (MEDIUM). An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries to use internal WAF filters to stop spec...

How severe is CVE-2017-8760?

CVE-2017-8760 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-8760?

Check the references section above for vendor advisories and patch information. Affected products include: Accellion File Transfer Appliance.