CVE-2019-18464: SQL Injection
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-18464?
CVE-2019-18464 refers to multiple SQL Injection vulnerabilities found in In Progress MOVEit Transfer versions 10.2 before 10.2.6, 11.0 before 11.0.4, and 11.1 before 11.1.3.
What is the severity rating of CVE-2019-18464?
CVE-2019-18464 has a severity rating of 9.8 (Critical).
How can an attacker exploit CVE-2019-18464?
An unauthenticated attacker can exploit CVE-2019-18464 by exploiting the SQL Injection vulnerabilities in the REST API to gain unauthorized access to the database.
Which versions of In Progress MOVEit Transfer are affected by CVE-2019-18464?
CVE-2019-18464 affects In Progress MOVEit Transfer versions 10.2 before 10.2.6, 11.0 before 11.0.4, and 11.1 before 11.1.3.
Are there any fixes available for CVE-2019-18464?
Yes, Ipswitch has released fixes for CVE-2019-18464. It is recommended to update to version 10.2.6, 11.0.4, or 11.1.3 or later to mitigate the vulnerabilities.