Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a home/seos/courier/login.html auth_params CRLF attack vector.
Feedly found the first article mentioning CVE-2017-8791. See article
CVE-2017-8791 is a critical vulnerability found in Accellion FTA devices prior to version FTA_9_12_180, which allows for a CRLF attack vector through the home/seos/courier/login.html auth_params. As of the date noted, there are no calculated CVSS scores, and it is unclear if the vulnerability is being actively exploited in the wild or if proof-of-concept exploits exist. There is no information provided regarding mitigations, detections, patches, or potential downstream impacts on third-party vendors or technology. See article
EPSS Score was set to: 0.11% (Percentile: 43.1%)