What is CVE-2019-18465?

CVE-2019-18465 is a critical-severity vulnerability in Ipswitch Moveit Transfer, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2019-10-31.

How severe is CVE-2019-18465?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Ipswitch Moveit Transfer

CVE-2019-18465

In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects only certain SSH (SFTP) configurations, and is applicable only if the MySQL database is being used.

Vulnerability class: Broken Authentication

EPSS: 0.015 (71.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Ipswitch Moveit_transfer
N/a — versions n/a

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Release Notes)
cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2019-18465?: CVE-2019-18465 is a critical-severity vulnerability in Ipswitch Moveit Transfer, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2019-10-31.
How severe is CVE-2019-18465?: Critical severity. CVSS v3 base score is 9.8 out of 10.