PT-2017-16421 · Biscom · Biscom Secure File Transfer

Publicado 2017-07-18 · Atualizado 2020-02-20 · CVE-2017-5247

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Biscom Secure File Transfer versions prior to 5.1.1028

Description The issue allows an authenticated user with upload or send file permissions to inject standard HTML scripting tags into the File Name field, which will be evaluated by other authenticated users viewing the file name.

Recommendations For versions prior to 5.1.1028, update to version 5.1.1028 to resolve the issue. As a temporary workaround, consider restricting access to file uploads and sends to trusted users only until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-5247

Produtos afetados

Biscom Secure File Transfer

Referências · 3

• https://twitter.com/i_bo0om/status/885050741567750145 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5247 · Nota de Segurança
• https://cve.biscom.com/bis-sft-cv-0005 · Nota