返回 CVE 瀏覽器

CVE-2019-18464

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0850%

EPSS Percentile21.08th

Published2019年10月31日

Last Modified2024年11月21日

Vulnerability Description

In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database.

Affected Platforms (CPE)

📦

Ipswitch

Moveit Transfer

>= 10.2.0 and < 10.2.6

📦

Ipswitch

Moveit Transfer

>= 11.0 and < 11.0.4

📦

Ipswitch

Moveit Transfer

>= 11.1 and < 11.1.3

References & Advisories

🔗 https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability-2

🔗 https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm

🔗 https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm

🔗 https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm

🔗 https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability-2

🔗 https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm

🔗 https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm

🔗 https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm

相關漏洞威脅

CVE-2021-381599.8

In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application co...

CVE-2023-343629.8

MOVEit Transfer SQL Injection vulnerability allows unauthenticated attackers to gain unauthorized access to MOVEit Transfer's data...

CVE-2019-184659.8

In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without ful...

CVE-2017-61959.8

Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017...