Description (CNA)
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Accellion / FTP Server | affected FTA_9_12_220 before FTA_9_12_220 |
CWE
CWE-204
References
- https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
- https://www.securityfocus.com/bid/96154
- https://www.kb.cert.org/vuls/id/745607
ADP enrichment
No English description supplied.