QID 376516
Date Published: 2022-04-26
QID 376516: IpSwitch MOVEit Transfer Critical Vulnerability
MOVEit Transfer Enterprise is a secure file transfer server. MOVEit DMZ safely and securely collects, stores, manages, and distributes sensitive information between your organization and external entities.
Ipswitch MOVEit Transfer (formerly DMZ) allows a SQL injection vulnerability in the MOVEit Transfer web application.
Affected Versions:
Prior to MOVEIt Transfer 2019.0.8 (11.0.8)
Prior to MOVEIt Transfer 2019.1.7 (11.1.7)
Prior to MOVEIt Transfer 2019.2.4 (11.2.4)
Prior to MOVEIt Transfer 2020.0.7 (12.0.7)
Prior to MOVEIt Transfer 2020.1.6 (12.1.6)
Prior to MOVEIt Transfer 2021.0.4 (13.0.4)
QID Detection Logic: (Authenticated)
It checks file version of SysStat.exe to check the vulnerable version of the product.
On successful attack could allow an un-authenticated attacker to gain unauthorized access to MOVEit Transfer's database.
CVEs related to QID 376516
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| CVE-2021-38159 | Windows |
community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-6-2021 |