CVE-2019-16383: SQL Injection
First published: Tue Sep 24 2019(Updated: )
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API, aka SQL Injection.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ipswitch Moveit Transfer | >=10.2.0<10.2.4 | |
| Ipswitch Moveit Transfer | >=11.0<11.0.2 | |
| Ipswitch Moveit Transfer | >=11.1<11.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/157208/MOVEit-Transfer-11.1.1-SQL-Injection.html
- https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability
- https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm
- https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm
- https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm
Frequently Asked Questions
What is CVE-2019-16383?
CVE-2019-16383 is a vulnerability that allows an unauthenticated attacker to gain unauthorized access to the database in Progress MOVEit Transfer versions 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1.
How does CVE-2019-16383 affect Ipswitch Moveit Transfer?
CVE-2019-16383 affects Ipswitch Moveit Transfer versions 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1.
What is the severity of CVE-2019-16383?
CVE-2019-16383 has a severity rating of 9.4 (Critical).
How can an attacker exploit CVE-2019-16383?
An attacker can exploit CVE-2019-16383 to gain unauthorized access to the database, depending on the database engine being used.
Are there any references available for CVE-2019-16383?
Yes, you can find more information about CVE-2019-16383 in the following references: [Reference 1](http://packetstormsecurity.com/files/157208/MOVEit-Transfer-11.1.1-SQL-Injection.html), [Reference 2](https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability), [Reference 3](https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/severity
- agent/tags
- agent/last-modified-date
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- vendor/ipswitch
- canonical/ipswitch moveit transfer
- version/ipswitch moveit transfer/10.2.0
- version/ipswitch moveit transfer/11.0
- version/ipswitch moveit transfer/11.1