#VU53659 Missing Authentication for Critical Function in MOVEit Transfer - CVE-2019-18465

Vulnerability identifier: #VU53659

Vulnerability risk: High

CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-18465

CWE-ID: CWE-306

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
MOVEit Transfer
Server applications / File servers (FTP/HTTP)

Vendor: Progress Software Corporation

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to a logic error that allows a remote authenticated attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects only certain SSH (SFTP) configurations, and is applicable only if the MySQL database is being used.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

MOVEit Transfer: before 2019.1.3

---

External links
https://community.ipswitch.com/s/article/SFTP-Auth-Vulnerability
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.