返回 CVE 浏览器

CVE-2015-7680

MEDIUM

5.3

CVSS Severity Score

EPSS Score0.1010%

EPSS Percentile39.35th

Published2016年2月10日

Last Modified2026年5月6日

Vulnerability Description

Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx.

Affected Platforms (CPE)

📦

Ipswitch

Moveit Dmz

<= 8.1

References & Advisories

🔗 http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf

🔗 http://packetstormsecurity.com/files/135462/Ipswitch-MOVEit-DMZ-8.1-Information-Disclosure.html

🔗 http://seclists.org/fulldisclosure/2016/Jan/95

🔗 https://profundis-labs.com/advisories/CVE-2015-7680.txt

🔗 http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf

🔗 http://packetstormsecurity.com/files/135462/Ipswitch-MOVEit-DMZ-8.1-Information-Disclosure.html

🔗 http://seclists.org/fulldisclosure/2016/Jan/95

🔗 https://profundis-labs.com/advisories/CVE-2015-7680.txt

相关漏洞威胁

CVE-2017-61959.8

Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017...

CVE-2015-76756.5

The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users...

CVE-2015-76765.4

Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote auth...

CVE-2015-76774.3

The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, ...