--- title: "Accellion File Transfer Appliance vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/accellion/file-transfer-appliance type: product description: "Accellion File Transfer Appliance has 20 published CVEs, 0 in CISA KEV and 19 with public exploits." updated: 2020-04-29 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Accellion File Transfer Appliance vulnerabilities Vendor: [Accellion](https://radicalnotion.ai/vendor/accellion) - **Published CVEs:** 20 - **In CISA KEV:** 0 - **With a public exploit:** 19 - **With a patch:** 1 - **Average CVSS:** 8.2 - **First CVE:** 2016-05-07 - **Latest CVE:** 2020-04-29 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 9 | | High | 4 | | Medium | 7 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5 | | [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3 | | [CWE-77](https://radicalnotion.ai/cwe/cwe-77) | Improper Neutralization of Special Elements used in a Command ('Command Injection') | 2 | | [CWE-93](https://radicalnotion.ai/cwe/cwe-93) | Improper Neutralization of CRLF Sequences ('CRLF Injection') | 2 | | [CWE-264](https://radicalnotion.ai/cwe/cwe-264) | Permissions, Privileges, and Access Controls | 2 | | [CWE-346](https://radicalnotion.ai/cwe/cwe-346) | Origin Validation Error | 1 | | [CWE-798](https://radicalnotion.ai/cwe/cwe-798) | Use of Hard-coded Credentials | 1 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2016 | 4 | | 2017 | 14 | | 2018 | 0 | | 2019 | 0 | | 2020 | 2 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | \<= 9\_12\_40 | range | 11 | | \<= 9\_11\_210 | range | 4 | | \>= FTA\_8\_0\_540 | range | 2 | | 8\_0\_540 | range | 2 | | \< 9\_12\_180 | range | 1 | | \<= 9\_11\_200 | range | 1 | | \<= fta\_9\_11\_200 | range | 1 | | 9\_12\_180 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2019-5623 | Accellion File Transfer Appliance Improper Neutralization of Special Elements used in a Command ('Command Injection') | critical | 9.8 | No | Yes | No | | CVE-2019-5622 | Accellion File Transfer Appliance Use of Hard-coded Credentials | critical | 9.8 | No | Yes | No | | CVE-2015-2856 | - | high | 7.5 | No | Yes | No | | CVE-2015-2857 | - | critical | 9.8 | No | Yes | No | | CVE-2017-8796 | - | critical | 9.8 | No | Yes | No | | CVE-2017-8795 | - | medium | 6.1 | No | Yes | No | | CVE-2017-8794 | - | critical | 10.0 | No | Yes | No | | CVE-2017-8793 | - | high | 8.8 | No | Yes | No | | CVE-2017-8792 | - | medium | 6.1 | No | Yes | No | | CVE-2017-8791 | - | medium | 6.1 | No | Yes | No | | CVE-2017-8790 | - | critical | 9.8 | No | Yes | No | | CVE-2017-8789 | - | critical | 9.8 | No | Yes | No | | CVE-2017-8788 | - | medium | 6.1 | No | Yes | No | | CVE-2017-8760 | - | medium | 6.1 | No | Yes | No | | CVE-2017-8304 | - | medium | 6.1 | No | Yes | No | | CVE-2017-8303 | - | critical | 9.8 | No | Yes | Yes | | CVE-2016-2353 | - | high | 7.8 | No | Yes | No | | CVE-2016-2352 | - | high | 8.8 | No | No | No | | CVE-2016-2351 | - | critical | 9.8 | No | Yes | No | | CVE-2016-2350 | - | medium | 6.1 | No | Yes | No | ## Frequently asked questions ### How many CVEs does Accellion File Transfer Appliance have? Accellion File Transfer Appliance has 20 published CVE records since 2016. ### How many Accellion File Transfer Appliance CVEs are in CISA KEV? None of Accellion File Transfer Appliance's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Accellion File Transfer Appliance vulnerabilities? Yes — 19 of Accellion File Transfer Appliance's CVEs have a known public exploit. ### Which versions of Accellion File Transfer Appliance are affected? 8 distinct Accellion File Transfer Appliance versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Accellion File Transfer Appliance CVEs? Accellion File Transfer Appliance's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection')). ### How many critical Accellion File Transfer Appliance vulnerabilities are there? Accellion File Transfer Appliance has 9 critical and 4 high-severity CVEs. ### What is the average severity of Accellion File Transfer Appliance CVEs? The average CVSS base score across Accellion File Transfer Appliance's scored CVEs is 8.2. ## Other products from this vendor - [kiteworks](https://radicalnotion.ai/vendor/accellion/kiteworks) (83 CVEs) - [secure file transfer appliance](https://radicalnotion.ai/vendor/accellion/secure-file-transfer-appliance) (7 CVEs) - [FTA](https://radicalnotion.ai/vendor/accellion/fta) (6 CVEs) - [kiteworks managed file transfer](https://radicalnotion.ai/vendor/accellion/kiteworks-managed-file-transfer) (4 CVEs) - [kiteworks appliance](https://radicalnotion.ai/vendor/accellion/kiteworks-appliance) (3 CVEs) - [Accellion FTA](https://radicalnotion.ai/vendor/accellion/accellion-fta) (2 CVEs) - [FTP Server](https://radicalnotion.ai/vendor/accellion/ftp-server) (2 CVEs) - [FTA 9\_12\_411 and earlier](https://radicalnotion.ai/vendor/accellion/fta-9-12-411-and-earlier) (1 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/accellion/file-transfer-appliance). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.