title: The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposure
description: Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.
problem types: CWE-80
affected:
{
product: FTP Server
vendor: Accellion
versions:
lessThan:  FTA_9_12_220, status: affected, version:  FTA_9_12_220, versionType: custom
}
solutions: Both issues have been addressed in the most recent version FTA_9_12_220, released on 31 January 2017. Previously, CVE-2016-9500 was addressed in FTA_9_12_160 released on 29 November 2016.