CVE-2017-5241 (GCVE-0-2017-5241)
Vulnerability from cvelistv5 – Published: 2017-06-28 13:00 – Updated: 2024-08-05 14:55
VLAI?
Summary
Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the "Name" and "Description" fields of a Workspace, as well as the "Description" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025.
Severity ?
No CVSS data available.
CWE
- Persistent Cross-Site Scripting
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Biscom | Secure File Transfer |
Affected:
5.0.0.0 trough 5.1.1024
|
Date Public ?
2017-06-27 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T14:55:35.822Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "99341",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99341"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cve.biscom.com/bis-sft-cv-003/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Secure File Transfer",
"vendor": "Biscom",
"versions": [
{
"status": "affected",
"version": "5.0.0.0 trough 5.1.1024"
}
]
}
],
"datePublic": "2017-06-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the \"Name\" and \"Description\" fields of a Workspace, as well as the \"Description\" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Persistent Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-20T21:20:14.000Z",
"orgId": "9974b330-7714-4307-a722-5648477acda7",
"shortName": "rapid7"
},
"references": [
{
"name": "99341",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99341"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cve.biscom.com/bis-sft-cv-003/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@rapid7.com",
"ID": "CVE-2017-5241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Secure File Transfer",
"version": {
"version_data": [
{
"version_value": "5.0.0.0 trough 5.1.1024"
}
]
}
}
]
},
"vendor_name": "Biscom"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the \"Name\" and \"Description\" fields of a Workspace, as well as the \"Description\" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Persistent Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "99341",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99341"
},
{
"name": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241",
"refsource": "MISC",
"url": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241"
},
{
"name": "https://cve.biscom.com/bis-sft-cv-003/",
"refsource": "CONFIRM",
"url": "https://cve.biscom.com/bis-sft-cv-003/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
"assignerShortName": "rapid7",
"cveId": "CVE-2017-5241",
"datePublished": "2017-06-28T13:00:00.000Z",
"dateReserved": "2017-01-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:55:35.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2017-5241",
"date": "2026-04-25",
"epss": "0.00388",
"percentile": "0.59921"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:biscom:secure_file_transfer:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"5.1.1015\", \"matchCriteriaId\": \"F9ECA38F-FE81-49EF-9B5C-58FBB19AE94F\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the \\\"Name\\\" and \\\"Description\\\" fields of a Workspace, as well as the \\\"Description\\\" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025.\"}, {\"lang\": \"es\", \"value\": \"Las versiones de Biscom Secure File Transfer 5.0.0.0 a 5.1.1024 son vulnerables a las secuencias cross-site scripting (XSS) persistentes posteriores a la autenticaci\\u00f3n (XSS) en los campos \\\"Name\\\" y \\\"Descripci\\u00f3n\\\" de un \\u00e1rea de trabajo, as\\u00ed como el campo \\\"Description\\\" de un Panel Detalles de archivo de un archivo almacenado en un espacio de trabajo. Este problema se resolvi\\u00f3 en la versi\\u00f3n 5.1.1025.\"}]",
"id": "CVE-2017-5241",
"lastModified": "2024-11-21T03:27:21.183",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:N/I:P/A:N\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2017-06-28T13:29:00.187",
"references": "[{\"url\": \"http://www.securityfocus.com/bid/99341\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://cve.biscom.com/bis-sft-cv-003/\", \"source\": \"cve@rapid7.com\"}, {\"url\": \"http://www.securityfocus.com/bid/99341\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://cve.biscom.com/bis-sft-cv-003/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@rapid7.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2017-5241\",\"sourceIdentifier\":\"cve@rapid7.com\",\"published\":\"2017-06-28T13:29:00.187\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the \\\"Name\\\" and \\\"Description\\\" fields of a Workspace, as well as the \\\"Description\\\" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025.\"},{\"lang\":\"es\",\"value\":\"Las versiones de Biscom Secure File Transfer 5.0.0.0 a 5.1.1024 son vulnerables a las secuencias cross-site scripting (XSS) persistentes posteriores a la autenticaci\u00f3n (XSS) en los campos \\\"Name\\\" y \\\"Descripci\u00f3n\\\" de un \u00e1rea de trabajo, as\u00ed como el campo \\\"Description\\\" de un Panel Detalles de archivo de un archivo almacenado en un espacio de trabajo. Este problema se resolvi\u00f3 en la versi\u00f3n 5.1.1025.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:biscom:secure_file_transfer:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.1.1015\",\"matchCriteriaId\":\"F9ECA38F-FE81-49EF-9B5C-58FBB19AE94F\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/99341\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://cve.biscom.com/bis-sft-cv-003/\",\"source\":\"cve@rapid7.com\"},{\"url\":\"http://www.securityfocus.com/bid/99341\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://cve.biscom.com/bis-sft-cv-003/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…