Description
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Accellion | FTP Server | FTA_9_12_220 – < FTA_9_12_220 | FTA_9_12_220 |
References
- https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
- 96154 vdb-entry
- VU#745607 third-party-advisory