PT-2020-20235 · Ipswitch+2 · Moveit Transfer+3

Published 2020-02-14 · Updated 2020-02-19 · CVE-2020-8611

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions 2019.1 through 2019.1.3 MOVEit Transfer versions 2019.2 through 2019.2.0

Description Multiple SQL Injection vulnerabilities have been found in the REST API of MOVEit Transfer, which could allow an authenticated attacker to gain unauthorized access to the database via the REST API. Depending on the database engine being used, such as MySQL, Microsoft SQL Server, or Azure SQL, an attacker may be able to infer information about the structure and contents of the database, in addition to executing SQL statements that alter or destroy database elements.

Recommendations For MOVEit Transfer versions 2019.1 through 2019.1.3, update to version 2019.1.4 or later. For MOVEit Transfer versions 2019.2 through 2019.2.0, update to version 2019.2.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-8611

Affected Products

Azure Sql

Moveit Transfer

Sql Server

Mysql Server

References · 7

• https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8611 · Vendor Advisory
• https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020 · Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8611 · Security Note
• https://t.me/cvenotify/1042 · Telegram Post
• https://status.moveitcloud.com · Note