Accellion vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Accellion flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2021-27104 Accellion FTA OS Command InjectionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
• CVE-2021-27103 Accellion FTA Server-Side Request Forgery (SSRF)Exploited since Nov 3, 2021 · ransomware · CVSS 9.8
• CVE-2021-27102 Accellion FTA OS Command InjectionExploited since Nov 3, 2021 · ransomware · CVSS 7.8
• CVE-2021-27101 Accellion FTA SQL InjectionExploited since Nov 3, 2021 · ransomware · CVSS 9.8

Latest high and critical flaws

• CVE-2021-31586 Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.High 8.8 · Jun 23, 2021
• CVE-2021-27730 Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint.Critical 9.8 · Mar 1, 2021
• CVE-2021-27104 Accellion FTA OS Command InjectionExploited · Critical 9.8 · Feb 16, 2021
• CVE-2021-27103 Accellion FTA Server-Side Request Forgery (SSRF)Exploited · Critical 9.8 · Feb 16, 2021
• CVE-2021-27102 Accellion FTA OS Command InjectionExploited · High 7.8 · Feb 16, 2021
• CVE-2021-27101 Accellion FTA SQL InjectionExploited · Critical 9.8 · Feb 16, 2021
• CVE-2019-5623 Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('CommanCritical 9.8 · Apr 29, 2020
• CVE-2019-5622 Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.Critical 9.8 · Apr 29, 2020
• CVE-2015-2856 Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackHigh 7.5 · Oct 10, 2017
• CVE-2015-2857 Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.Critical 9.8 · Aug 22, 2017
• CVE-2017-8796 An issue was discovered on Accellion FTA devices before FTA_9_12_180.Critical 9.8 · May 5, 2017
• CVE-2017-8794 An issue was discovered on Accellion FTA devices before FTA_9_12_180.Critical 10 · May 5, 2017
• CVE-2017-8793 An issue was discovered on Accellion FTA devices before FTA_9_12_180.High 8.8 · May 5, 2017
• CVE-2017-8790 An issue was discovered on Accellion FTA devices before FTA_9_12_180.Critical 9.8 · May 5, 2017
• CVE-2017-8789 An issue was discovered on Accellion FTA devices before FTA_9_12_180.Critical 9.8 · May 5, 2017
• CVE-2017-8303 An issue was discovered on Accellion FTA devices before FTA_9_12_180.Critical 9.8 · May 5, 2017
• CVE-2016-5662 Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vecHigh 7.8 · Aug 26, 2016
• CVE-2016-2353 The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, viaHigh 7.8 · May 7, 2016
• CVE-2016-2352 The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restHigh 8.8 · May 7, 2016
• CVE-2016-2351 SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to Critical 9.8 · May 7, 2016
• CVE-2009-4648 Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privilegeHigh 7.2 · Feb 19, 2010
• CVE-2009-4646 Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators tHigh 9 · Feb 19, 2010
• CVE-2009-4645 Directory traversal vulnerability in web_client_user_guide.html in Accellion Secure File Transfer Appliance before 8_0_105 allows remote attackers to read arbitHigh 7.8 · Feb 19, 2010
• CVE-2009-4644 Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commandsHigh 9 · Feb 19, 2010
• CVE-2008-7012 courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and possibly other versions before FTA_7_0_189High 7.8 · Aug 19, 2009