PT-2017-16420 · Google+1 · Angularjs+1

Publicado 2017-07-18 · Atualizado 2020-02-20 · CVE-2017-5246

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Biscom Secure File Transfer versions 5.0.0000 through 5.1.1026

Description The issue concerns AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}), which will be evaluated by any other authenticated user who views the attacker's display name.

Recommendations For versions 5.0.0000 through 5.1.1026, update to version 5.1.1028 to resolve the issue. As a temporary workaround, consider restricting access to the Display Name field until the update is applied.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-5246

Produtos afetados

Angularjs

Biscom Secure File Transfer

Referências · 3

• https://twitter.com/i_bo0om/status/885050741567750145 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5246 · Nota de Segurança
• https://cve.biscom.com/bis-sft-cv-0004 · Nota