« Volver al listado

CVE-2017-6195

Estado: ModificadaCrítica (9.8)—

Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Ipswitch — Moveit DMZIpswitch — Moveit Transfer 2017

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-6195",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-05-18T06:29:00.217",
  "references": [
    {
      "url": "http://ft.ipswitch.com/rs/751-HBN-596/images/Ipswitch-Security-Bulletin-FT-Vulnerability.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.siberas.de/assets/papers/ssa-1705_IPSWITCH_SQLinjection.txt",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://ft.ipswitch.com/rs/751-HBN-596/images/Ipswitch-Security-Bulletin-FT-Vulnerability.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.siberas.de/assets/papers/ssa-1705_IPSWITCH_SQLinjection.txt",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20."
    },
    {
      "lang": "es",
      "value": "Ipswitch MOVEit Transfer (anteriormente conocido como DMZ) permite inyección SQL ciega de preautenticación. Las versiones solucionadas son MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30 y MOVEit DMZ 8.2.0.20."
    }
  ],
  "lastModified": "2026-06-17T01:21:55.507",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ipswitch:moveit_dmz:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8C09B13-29FD-4A22-A77F-83B9434DBE33",
              "versionEndIncluding": "8.1"
            },
            {
              "criteria": "cpe:2.3:a:ipswitch:moveit_dmz:8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "517F2B03-DE60-46C9-97C5-519674DE06CE"
            },
            {
              "criteria": "cpe:2.3:a:ipswitch:moveit_dmz:8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EED1AB9F-7CB4-4FEB-8500-14BF04BD7EA3"
            },
            {
              "criteria": "cpe:2.3:a:ipswitch:moveit_transfer_2017:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C3FE905-F481-45AF-B1B3-A85A5F638C56"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}