Accellion File Transfer Appliance Multiple Vulnerabilities

vendor:

File Transfer Appliance

by:

Unknown

7.5

CVSS

HIGH

Multiple vulnerabilities including privilege escalation, directory traversal, HTML injection, and remote command injection

Unknown

CWE

Product Name: File Transfer Appliance

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Unknown

CPE: Unknown

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Accellion File Transfer Appliance Multiple Vulnerabilities

The vulnerabilities allow an attacker to execute arbitrary script code, steal authentication credentials, obtain sensitive information, and execute arbitrary code or commands with superuser privileges.

Mitigation:

Unknown

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/38176/info

Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including:

- Multiple privilege-escalation issues
- A directory-traversal issue
- An HTML-injection issue
- A remote command-injection issue

An attacker may leverage these issues to execute arbitrary script code within the context of the webserver, steal cookie-based authentication credentials, obtain sensitive information, and execute arbitrary code or commands with superuser privileges. Other attacks are also possible. 

https://www.example.com/courier/1000@1276123d688676a09e0100b4f54b239c/web_client_user_guide.html?lang=../../../../../etc/passwd