medium5.3
CVE-2016-9499
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid.
Impact
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Accellion | Ftp Server | before fta_9_12_220 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.kb.cert.org/vuls/id/745607
- https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
- https://www.securityfocus.com/bid/96154
- https://www.kb.cert.org/vuls/id/745607
- https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
- https://www.securityfocus.com/bid/96154