CVE-2017-5241 - OpenCVE

Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the "Name" and "Description" fields of a Workspace, as well as the "Description" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Biscom	Secure File Transfer

Configuration 1 [-]

cpe:2.3:a:biscom:secure_file_transfer:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/99341
https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241
https://cve.biscom.com/bis-sft-cv-003/

History

No history.

MITRE

Status: PUBLISHED

Assigner: rapid7

Published: 2017-06-28T13:00:00

Updated: 2024-08-05T14:55:35.822Z

Reserved: 2017-01-09T00:00:00

Link: CVE-2017-5241

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-06-28T13:29:00.187

Modified: 2020-02-20T22:15:10.880

Link: CVE-2017-5241

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Secure File Transfer", "vendor": "Biscom", "versions": [{"status": "affected", "version": "5.0.0.0 trough 5.1.1024"}]}], "datePublic": "2017-06-27T00:00:00", "descriptions": [{"lang": "en", "value": "Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the \"Name\" and \"Description\" fields of a Workspace, as well as the \"Description\" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025."}], "problemTypes": [{"descriptions": [{"description": "Persistent Cross-Site Scripting", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-20T21:20:14", "orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7"}, "references": [{"name": "99341", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99341"}, {"tags": ["x_refsource_MISC"], "url": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://cve.biscom.com/bis-sft-cv-003/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@rapid7.com", "ID": "CVE-2017-5241", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Secure File Transfer", "version": {"version_data": [{"version_value": "5.0.0.0 trough 5.1.1024"}]}}]}, "vendor_name": "Biscom"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the \"Name\" and \"Description\" fields of a Workspace, as well as the \"Description\" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Persistent Cross-Site Scripting"}]}]}, "references": {"reference_data": [{"name": "99341", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99341"}, {"name": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241", "refsource": "MISC", "url": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241"}, {"name": "https://cve.biscom.com/bis-sft-cv-003/", "refsource": "CONFIRM", "url": "https://cve.biscom.com/bis-sft-cv-003/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T14:55:35.822Z"}, "title": "CVE Program Container", "references": [{"name": "99341", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99341"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cve.biscom.com/bis-sft-cv-003/"}]}]}, "cveMetadata": {"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "assignerShortName": "rapid7", "cveId": "CVE-2017-5241", "datePublished": "2017-06-28T13:00:00", "dateReserved": "2017-01-09T00:00:00", "dateUpdated": "2024-08-05T14:55:35.822Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:biscom:secure_file_transfer:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9ECA38F-FE81-49EF-9B5C-58FBB19AE94F", "versionEndIncluding": "5.1.1015", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the \"Name\" and \"Description\" fields of a Workspace, as well as the \"Description\" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025."}, {"lang": "es", "value": "Las versiones de Biscom Secure File Transfer 5.0.0.0 a 5.1.1024 son vulnerables a las secuencias cross-site scripting (XSS) persistentes posteriores a la autenticaci\u00f3n (XSS) en los campos \"Name\" y \"Descripci\u00f3n\" de un \u00e1rea de trabajo, as\u00ed como el campo \"Description\" de un Panel Detalles de archivo de un archivo almacenado en un espacio de trabajo. Este problema se resolvi\u00f3 en la versi\u00f3n 5.1.1025."}], "id": "CVE-2017-5241", "lastModified": "2020-02-20T22:15:10.880", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-28T13:29:00.187", "references": [{"source": "cve@rapid7.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99341"}, {"source": "cve@rapid7.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241"}, {"source": "cve@rapid7.com", "url": "https://cve.biscom.com/bis-sft-cv-003/"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}