Vulnerability Details CVE-2017-8794
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 54.8%
CVSS Severity
CVSS v3 Score 10.0
CVSS v2 Score 6.4
References
Products affected by CVE-2017-8794
-
cpe:2.3:a:accellion:file_transfer_appliance:8_0_540
-
cpe:2.3:a:accellion:file_transfer_appliance:9_11_200
-
cpe:2.3:a:accellion:file_transfer_appliance:9_11_210