PT-2018-17625 · Ipswitch · Ipswitch Moveit

Published 2018-02-02 · Updated 2018-02-14 · CVE-2018-6545

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ipswitch MoveIt version 8.1

Description The issue allows attackers to leverage a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by the "human.aspx" endpoint, to send malicious messages to other users. This can lead to the theft of session cookies and the launch of client-side attacks.

Recommendations For Ipswitch MoveIt version 8.1, consider disabling access to the "human.aspx" endpoint as a temporary workaround until a patch is available. Restrict the ability for users to send messages that may contain malicious scripts to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-6545

Affected Products

Ipswitch Moveit

References · 3

• 🔥 https://crowdshield.com/blog.php?name=ipswitch-moveit-stored-xss · Exploit
• https://osv.dev/vulnerability/CVE-2018-6545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6545 · Security Note