CVE-2021-27731
CVE-2021-27731 is a medium-severity vulnerability in Accellion Fta with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.
Key facts
- Severity: Medium (CVSS 3.x base score 6.1)
- CVSS v2: 4.3
- EPSS exploit prediction: 1% (50th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-79
- Affected product: Accellion Fta
- Published:
- Last modified:
Description
Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later.
Frequently asked questions
- What is CVE-2021-27731?
- Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later.
- How severe is CVE-2021-27731?
- CVE-2021-27731 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2021-27731 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-27731?
- CVE-2021-27731 affects Accellion Fta. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-27731?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2021-27731 published?
- CVE-2021-27731 was published on 2021-03-02 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:accellion:fta:*:*:*:*:*:*:*:*
More vulnerabilities in Accellion Fta
- CVE-2021-27730 — Critical (CVSS 9.8): Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint.…
- CVE-2021-27104 — Critical (CVSS 9.8): Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin…
- CVE-2021-27103 — Critical (CVSS 9.8): Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed…
- CVE-2021-27101 — Critical (CVSS 9.8): Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to…
- CVE-2021-27102 — High (CVSS 7.8): Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version…
All CVEs affecting Accellion Fta →
Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities
- CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
- CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
- CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
- CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
- CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
- CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…
Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →