PT-2017-16420
CVE-2017-5246
·
تاريخ النشر
2017-07-18
·
تاريخ التحديث
2020-02-20
الوصف من
CVSS 2.0
4.0
متوسطةالمقاييسAV:N/AC:L/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
Biscom Secure File Transfer versions 5.0.0000 through 5.1.1026
Description
The issue concerns AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}), which will be evaluated by any other authenticated user who views the attacker's display name.
Recommendations
For versions 5.0.0000 through 5.1.1026, update to version 5.1.1028 to resolve the issue.
As a temporary workaround, consider restricting access to the Display Name field until the update is applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾