CVE-2017-5247: Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field

Routine

MEDIUM 5.4MITIGATE

CVE-2017-5247 is a medium-severity flaw (CVSS 5.4) affecting secure file transfer. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. An authenticated user with permissions to upload or send files can populate this field with a filename that contains standard HTML scripting tags. The resulting script will evaluated by any other authenticated user who views the attacker-supplied file name. All versions of SFT prior to 5.1.1028 are affected. The fix version is 5.1.1028.

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.5% (top 57%)
CISA exploited list	No
Weakness	CWE-79
Published	2017-07-18
Last modified	2026-06-17

Publisher (CNA): Rapid7, Inc. · Vendor: biscom

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2017-07-18 18:29 UTCPublished CVE record published
2026-06-17 01:20 UTCUpdated Record last modified

biscom secure file transfer MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy secure-file-transfer || rpm -q secure-file-transfer || secure-file-transfer --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2017-5247?

secure file transfer: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2017-5247 being exploited?

CVE-2017-5247 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2017-5247 affect?

CVE-2017-5247 affects secure file transfer. Severity is medium (CVSS 5.4). Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. An authenticated user with permissions to upload or send files can populate this field with a filename that contains standard HTML scripting tags. The

How urgent is CVE-2017-5247?

Priority 30/100. No elevated risk signals yet.

Related CVEs

CVE-2020-8796 CRITICAL 9.8 UPGRADE Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on
CVE-2020-8503 MEDIUM 6.5 UPGRADE Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Dire
CVE-2020-27646 MEDIUM 6.5 UPGRADE Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.
CVE-2017-5246 MEDIUM 4.3 MITIGATE Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field
CVE-2017-5241 MEDIUM 5.4 UPGRADE Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent

References

← Back to latest CVEs