CVE-2019-18464: SQL Injection
First published: Thu Oct 31 2019(Updated: )
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ipswitch Moveit Transfer | >=10.2.0<10.2.6 | |
| Ipswitch Moveit Transfer | >=11.0<11.0.4 | |
| Ipswitch Moveit Transfer | >=11.1<11.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability-2
- https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm
- https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm
- https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm
Frequently Asked Questions
What is CVE-2019-18464?
CVE-2019-18464 refers to multiple SQL Injection vulnerabilities found in In Progress MOVEit Transfer versions 10.2 before 10.2.6, 11.0 before 11.0.4, and 11.1 before 11.1.3.
What is the severity rating of CVE-2019-18464?
CVE-2019-18464 has a severity rating of 9.8 (Critical).
How can an attacker exploit CVE-2019-18464?
An unauthenticated attacker can exploit CVE-2019-18464 by exploiting the SQL Injection vulnerabilities in the REST API to gain unauthorized access to the database.
Which versions of In Progress MOVEit Transfer are affected by CVE-2019-18464?
CVE-2019-18464 affects In Progress MOVEit Transfer versions 10.2 before 10.2.6, 11.0 before 11.0.4, and 11.1 before 11.1.3.
Are there any fixes available for CVE-2019-18464?
Yes, Ipswitch has released fixes for CVE-2019-18464. It is recommended to update to version 10.2.6, 11.0.4, or 11.1.3 or later to mitigate the vulnerabilities.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/ipswitch
- canonical/ipswitch moveit transfer
- version/ipswitch moveit transfer/10.2.0
- version/ipswitch moveit transfer/11.0
- version/ipswitch moveit transfer/11.1