CVE-2016-9499CWE-204

The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.

published July 13, 2018

CVSS
—
EPSS
8%
Percentile
94.5
In the wild
Unconfirmed
What it is

Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07669 · 94.5th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2018-07-13T20:00Z
EPSS history
Timeline
  • 13 JUL 20:00Z
    The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.
    cvelistv5