CVE-2021-27101criticalunder attackransomware

CVE-2021-27101

Published · Updated

Follow this CVE+ Monitor FTA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 6.0%
from disclosure to weapon2029 days
Published on NVDFeb 16
1st PoC+2029d
CISA KEV+260d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

Accellion FTA versions 9.12.370 and earlier have a critical flaw that allows attackers to inject malicious SQL commands through specially crafted requests to a specific web page, potentially exposing or modifying sensitive data stored in the application's database.

Technical detail

SQL injection vulnerability in Accellion FTA ≤9.12.370 exploitable via malicious Host header in requests to document_root.html endpoint. Attack requires network access to the vulnerable application; successful exploitation enables arbitrary SQL query execution and potential unauthorized database access or modification.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.