PT-2019-15421 · Microsoft+2 · Azure Sql+3

Publicado 2019-10-31 · Atualizado 2019-11-06 · CVE-2019-18464

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions 10.2 through 10.2.6 MOVEit Transfer versions 11.0 through 11.0.4 MOVEit Transfer versions 11.1 through 11.1.3

Description Multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used, such as MySQL, Microsoft SQL Server, or Azure SQL, an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database.

Recommendations For MOVEit Transfer versions 10.2 through 10.2.6, update to version 10.2.6 or later. For MOVEit Transfer versions 11.0 through 11.0.4, update to version 11.0.4 or later. For MOVEit Transfer versions 11.1 through 11.1.3, update to version 11.1.3 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-18464

Produtos afetados

Azure Sql

Moveit Transfer

Sql Server

Mysql Server

Referências · 6

• https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm · Aviso do Fabricante
• https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm · Aviso do Fabricante
• https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18464 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18464 · Aviso do Fabricante
• https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability-2 · Aviso do Fabricante