PT-2019-15422 · Ipswitch · Moveit Transfer

Publicado 2019-10-31 · Atualizado 2019-11-04 · CVE-2019-18465

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions 11.1 through 11.1.2

Description A vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface. The issue affects only certain SSH (SFTP) configurations and is applicable only if the MySQL database is being used.

Recommendations For MOVEit Transfer versions 11.1 through 11.1.2, update to version 11.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSH (SFTP) interface until the update is applied.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-18465

Produtos afetados

Moveit Transfer

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-18465 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18465 · Aviso do Fabricante
• https://community.ipswitch.com/s/article/SFTP-Auth-Vulnerability · Nota
• https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm · Nota