title: The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.
description: Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
problem types: CWE-204
affected:
{
product: FTP Server
vendor: Accellion
versions:
lessThan:  FTA_9_12_220, status: affected, version:  FTA_9_12_220, versionType: custom
}
solutions: Both issues have been addressed in the most recent version FTA_9_12_220, released on 31 January 2017. Previously, CVE-2016-9500 was addressed in FTA_9_12_160 released on 29 November 2016.