Medium severity · published Jul 13, 2018
CVE-2016-9499
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid
5.3
CVSS
7.7%
EPSS
No
On KEV
Description
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FS
Ftp Server · Accellion
before fta_9_12_220 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9499
Third Party Advisory
https://www.kb.cert.org/vuls/id/745607
Exploit
https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
Third Party Advisory
https://www.securityfocus.com/bid/96154
More from Ftp Server
6.1
CVE-2016-9500
Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image)…