CVE-2020-8611: In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to g...

Summary

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engin...

What to do

Update progess moveit_transfer to version 2019.1.4 or later.
Update progress moveit_transfer to version 2019.2.1 or later.

Affected software

Vendor	Product	Affected versions
progess	moveit_transfer	>= 2019.1, < 2019.1.4 `cpe:2.3:a:progess:moveit_transfer::::::::`
progress	moveit_transfer	>= 2019.2, < 2019.2.1 `cpe:2.3:a:progress:moveit_transfer::::::::`

Original advisory text

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to g...

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements.

References

https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilitie... Vendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.... Release Notes Vendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.... Release Notes Vendor Advisory
https://status.moveitcloud.com/ Product