CVE-2019-16383

🗓️ 24 Sep 2019 14:34:34Reported by mitreType

cve🔗 web.nvd.nist.gov👁 78 Views🌐 WEB

Progress MOVEit Transfer 2018 SP2 and 2019 before 11.0.2 allows unauthorized database acces

Reporter	Title	Published	Views	Family All 12
0day.today	MOVEit Transfer 11.1.1 - (token) Unauthenticated SQL Injection Vulnerability	13 Apr 202000:00	–	zdt
Circl	CVE-2019-16383	14 Nov 202406:07	–	circl
CNVD	Progress Software MOVEit Transfer SQL Injection Vulnerability	25 Sep 201900:00	–	cnvd
Check Point Advisories	SQL Servers Time-based SQL Injection (CVE-2011-4710; CVE-2019-13978; CVE-2019-16065; CVE-2019-16119; CVE-2019-16383; CVE-2019-16692; CVE-2020-15468; CVE-2020-26518; CVE-2020-29284; CVE-2021-21915; CVE-2021-21916; CVE-2021-21917; CVE-2022-23337; CVE-2022-25149)	26 May 201400:00	–	checkpoint_advisories
Cvelist	CVE-2019-16383	24 Sep 201914:34	–	cvelist
Exploit DB	MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection	13 Apr 202000:00	–	exploitdb
Exploit DB	MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection	5 Oct 202000:00	–	exploitdb
EUVD	EUVD-2019-7133	7 Oct 202500:30	–	euvd
NVD	CVE-2019-16383	24 Sep 201915:15	–	nvd
Packet Storm	MOVEit Transfer 11.1.1 SQL Injection	13 Apr 202000:00	–	packetstorm

NVD

Node

Source	Link
community	www.community.ipswitch.com/s/article/SQL-Injection-Vulnerability
docs	www.docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm
docs	www.docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm
docs	www.docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm
packetstormsecurity	www.packetstormsecurity.com/files/157208/MOVEit-Transfer-11.1.1-SQL-Injection.html

Parameter	Position	Path	Description	CWE
token	request body	api/v1/token/revoke	Unauthenticated SQL injection via the token parameter in POST /api/v1/token/revoke (time-based blind SQLi example shows vulnerability to SQL injection through token).	CWE-89

21 Nov 2024 04:30Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 3.19.4

EPSS0.01091