How severe is CVE-2017-8793?

CVE-2017-8793 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-8793 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-8793?

CVE-2017-8793 affects Accellion File Transfer Appliance. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-8793?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2017-8793 published?

CVE-2017-8793 was published on 2017-05-05 and last updated on 2026-06-17.

CVE-2017-8793

CVE-2017-8793 is a high-severity vulnerability in Accellion File Transfer Appliance with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-346.

Key facts

Severity: High (CVSS 3.x base score 8.8)
CVSS v2: 6.8
EPSS exploit prediction: 1% (40th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-346
Affected product: Accellion File Transfer Appliance
Published: 2017-05-05
Last modified: 2026-06-17

Description

An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site access with a bypass of the Same Origin Policy.

Frequently asked questions

What is CVE-2017-8793?: An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site access with a bypass of the Same Origin Policy.
How severe is CVE-2017-8793?: CVE-2017-8793 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-8793 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-8793?: CVE-2017-8793 affects Accellion File Transfer Appliance. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-8793?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2017-8793 published?: CVE-2017-8793 was published on 2017-05-05 and last updated on 2026-06-17.

References

https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb

Affected products (1)

cpe:2.3:a:accellion:file_transfer_appliance:*:*:*:*:*:*:*:*

More vulnerabilities in Accellion File Transfer Appliance

CVE-2017-8794 — Critical (CVSS 10.0): An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match…
CVE-2019-5623 — Critical (CVSS 9.8): Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of…
CVE-2019-5622 — Critical (CVSS 9.8): Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded…
CVE-2015-2857 — Critical (CVSS 9.8): Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell…
CVE-2017-8796 — Critical (CVSS 9.8): An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because mysql_real_escape_string is misused,…
CVE-2017-8790 — Critical (CVSS 9.8): An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST…

All CVEs affecting Accellion File Transfer Appliance →

Other CWE-346 vulnerabilities

CVE-2026-42901 — Critical (CVSS 10.0): Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-6508 — Critical (CVSS 9.8): Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows…
CVE-2026-2790 — Critical (CVSS 9.8): Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR…
CVE-2022-50925 — Critical (CVSS 9.8): Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send…
CVE-2025-30466 — Critical (CVSS 9.8): This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS…
CVE-2024-8487 — Critical (CVSS 9.8): A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS…

Browse all CWE-346 vulnerabilities →