Back to CVE Browser

CVE-2015-7677

MEDIUM

4.3

CVSS Severity Score

EPSS Score0.0140%

EPSS Percentile40.26th

PublishedFeb 10, 2016

Last ModifiedMay 6, 2026

Vulnerability Description

The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll.

Affected Platforms (CPE)

📦

Ipswitch

Moveit Dmz

<= 8.1

References & Advisories

🔗 http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf

🔗 http://packetstormsecurity.com/files/135459/Ipswitch-MOVEit-DMZ-8.1-File-ID-Enumeration.html

🔗 http://seclists.org/fulldisclosure/2016/Jan/95

🔗 https://www.profundis-labs.com/advisories/CVE-2015-7677.txt

🔗 http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf

🔗 http://packetstormsecurity.com/files/135459/Ipswitch-MOVEit-DMZ-8.1-File-ID-Enumeration.html

🔗 http://seclists.org/fulldisclosure/2016/Jan/95

🔗 https://www.profundis-labs.com/advisories/CVE-2015-7677.txt

Related Vulnerabilities

CVE-2017-61959.8

Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017...

CVE-2015-76756.5

The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users...

CVE-2015-76765.4

Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote auth...

CVE-2015-76805.3

Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account...