CVE-2019-18465 - In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface

Back Back to CVE browser

CRITICAL

In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface

Published Oct 31, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.49%

Description

In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects only certain SSH (SFTP) configurations, and is applicable only if the MySQL database is being used.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

https://community.ipswitch.com/s/article/SFTP-Auth-Vulnerability
x_refsource_CONFIRMThird Party Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm
x_refsource_CONFIRMRelease NotesThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8215
Advisory

Link	Providers	Tags
https://community.ipswitch.com/s/article/SFTP-Auth-Vulnerability		x_refsource_CONFIRMThird Party Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm		x_refsource_CONFIRMRelease NotesThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8215		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 31, 2019

Updated Aug 5, 2024

Reserved Oct 25, 2019

Link CVE-2019-18465

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-18465

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Oct 31, 2019

Updated Aug 5, 2024

Link EUVD-2019-8215

GitHub

No data