PT-2017-16421 · Biscom · Biscom Secure File Transfer

Published 2017-07-18 · Updated 2020-02-20 · CVE-2017-5247

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Biscom Secure File Transfer versions prior to 5.1.1028

Description The issue allows an authenticated user with upload or send file permissions to inject standard HTML scripting tags into the File Name field, which will be evaluated by other authenticated users viewing the file name.

Recommendations For versions prior to 5.1.1028, update to version 5.1.1028 to resolve the issue. As a temporary workaround, consider restricting access to file uploads and sends to trusted users only until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-5247

Affected Products

Biscom Secure File Transfer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-5247 · Security Note
• https://twitter.com/i_bo0om/status/885050741567750145 · Note
• https://cve.biscom.com/bis-sft-cv-0005 · Note