CVE-2017-5246

Name of the Vulnerable Software and Affected Versions Biscom Secure File Transfer versions 5.0.0000 through 5.1.1026

Description The issue concerns AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}), which will be evaluated by any other authenticated user who views the attacker's display name.

Recommendations For versions 5.0.0000 through 5.1.1026, update to version 5.1.1028 to resolve the issue. As a temporary workaround, consider restricting access to the Display Name field until the update is applied.