Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Accellion File Transfer Appliance allows LDAP injection via filter

CVE-2017-8790 · published 9 years ago
Summary

The Accellion File Transfer Appliance (versions before FTA 9.12.180) accepts a web request that can insert malicious LDAP commands through the "filter" field. This could let an attacker read, modify, or delete directory data stored in your LDAP server. Apply the vendor's update or patch to a newer version to close the flaw.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
accellion file_transfer_appliance <= 9_12_40
cpe:2.3:a:accellion:file_transfer_appliance:*:*:*:*:*:*:*:*
Original advisory text
An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection.
An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Timeline
Published5 May 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-8790 · NVD
Track software like this
Free during beta