PT-2017-16420 · Google+1 · Angularjs+1

Published 2017-07-18 · Updated 2020-02-20 · CVE-2017-5246

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Biscom Secure File Transfer versions 5.0.0000 through 5.1.1026

Description The issue concerns AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}), which will be evaluated by any other authenticated user who views the attacker's display name.

Recommendations For versions 5.0.0000 through 5.1.1026, update to version 5.1.1028 to resolve the issue. As a temporary workaround, consider restricting access to the Display Name field until the update is applied.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-5246

Affected Products

Angularjs

Biscom Secure File Transfer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-5246 · Security Note
• https://twitter.com/i_bo0om/status/885050741567750145 · Note
• https://cve.biscom.com/bis-sft-cv-0004 · Note