CVE-2017-5241

Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the "Name" and "Description" fields of a Workspace, as well as the "Description" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025.

• CWE-79

• http://www.securityfocus.com/bid/99341Third Party Advisory, VDB Entry
• https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241Exploit, Third Party Advisory, VDB Entry
• https://cve.biscom.com/bis-sft-cv-003/
• http://www.securityfocus.com/bid/99341Third Party Advisory, VDB Entry
• https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241Exploit, Third Party Advisory, VDB Entry
• https://cve.biscom.com/bis-sft-cv-003/

Published

Jun 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5235Rapid7 Metasploit Pro installers prior to version 4.13.0-201…
• CVE-2017-5236Editions of Rapid7 AppSpider Pro installers prior to version…
• CVE-2017-5237Due to a lack of authentication, an unauthenticated user who…
• CVE-2017-5238Due to a lack of bounds checking, several input configuratio…
• CVE-2017-5239Due to a lack of standard encryption when transmitting sensi…
• CVE-2017-5240Editions of Rapid7 AppSpider Pro prior to version 6.14.060 c…
• CVE-2017-5242Nexpose and InsightVM virtual appliances downloaded between …7.7
• CVE-2017-5243The default SSH configuration in Rapid7 Nexpose hardware app…
• CVE-2017-5244Routes used to stop running Metasploit tasks (either particu…
• CVE-2017-5245Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-5246Biscom Secure File Transfer is vulnerable to AngularJS expre…
• CVE-2017-5247Biscom Secure File Transfer is vulnerable to cross-site scri…