PatchTheCVEsecure file transfer vulnerabilities and fixes
Recent CVEs affecting secure file transfer, with upgrade or downgrade steps. 7 tracked.
Also searched as: securefiletransfer.
secure file transfer has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2020-10-22. Highest priority: CVE-2020-8796 (score 61/100).
- CVE-2020-8796 CRITICAL 9.8 UPGRADE Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on
- CVE-2020-8503 MEDIUM 6.5 UPGRADE Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Dire
- CVE-2020-27646 MEDIUM 6.5 UPGRADE Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.
- CVE-2017-5247 MEDIUM 5.4 MITIGATE Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field
- CVE-2017-5246 MEDIUM 4.3 MITIGATE Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field
- CVE-2017-5241 MEDIUM 5.4 UPGRADE Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent
- CVE-2016-10710 HIGH 8.1 UPGRADE Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses
FAQ
How do I fix secure file transfer vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is secure file transfer being exploited right now?
None of the tracked secure file transfer CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which secure file transfer CVE should I patch first?
CVE-2020-8796 currently ranks highest (61/100): Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on.