CVE-2017-8793

Published: May 5, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site access with a bypass of the Same Origin Policy.

Affected (1)

Products: Accellion: File Transfer Appliance

1 product

File Transfer Appliance

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Accellion File Transfer Appliance	Up to 9_12_40

Related CWEs

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (2)

https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb

Source: cve@mitre.org

ExploitThird Party Advisory

https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.