Missing Authentication for Critical Function in MOVEit Transfer - CVE-2019-18465
Published: May 30, 2021
Vulnerability identifier: #VU53659
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-18465
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to a logic error that allows a remote authenticated attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects only certain SSH (SFTP) configurations, and is applicable only if the MySQL database is being used.
Affected software
MOVEit Transfer
How to mitigate CVE-2019-18465
Install updates from vendor's website.
MOVEit Transfer - update to 2019.1.3