PT-2019-14650 · Microsoft+2 · Azure Sql+3

Publicado 2019-09-24 · Atualizado 2020-04-14 · CVE-2019-16383

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress MOVEit Transfer versions 2018 SP2 before 10.2.4 Progress MOVEit Transfer versions 2019 before 11.0.2 Progress MOVEit Transfer versions 2019.1 before 11.1.1

Description The issue allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used, such as MySQL, Microsoft SQL Server, or Azure SQL, an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API.

Recommendations For Progress MOVEit Transfer 2018 SP2, update to version 10.2.4 or later. For Progress MOVEit Transfer 2019, update to version 11.0.2 or later. For Progress MOVEit Transfer 2019.1, update to version 11.1.1 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-16383

Produtos afetados

Azure Sql

Moveit Transfer

Sql Server

Mysql Server

Referências · 8

• 🔥 https://exploit-db.com/exploits/48316 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16383 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-16383 · Aviso do Fabricante
• https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm · Aviso do Fabricante
• https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm · Aviso do Fabricante
• https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability · Aviso do Fabricante
• https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm · Aviso do Fabricante
• http://packetstormsecurity.com/files/157208/MOVEit-Transfer-11.1.1-SQL-Injection.html · Nota