VulnerabilityModified
CVE-2015-7675
The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the (1) serverFileIds parameter to mobile/sendMsg or…
MEDIUM 6.5EPSS 3.11%
Does this matter?
Lower severity and a low EPSS score (3.11%). Track it; it rarely justifies an emergency change on its own.
Description
The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the (1) serverFileIds parameter to mobile/sendMsg or (2) arg01 parameter to human.aspx.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 3.11% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- ipswitch/moveit dmz · ipswitch/moveit mobile
- Source
- cve@mitre.org
References
- http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdfVendor Advisory
- http://packetstormsecurity.com/files/135457/Ipswitch-MOVEit-DMZ-8.1-Authorization-Bypass.htmlExploit
- http://seclists.org/fulldisclosure/2016/Jan/95
- https://www.profundis-labs.com/advisories/CVE-2015-7675.txtExploit
- http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdfVendor Advisory
- http://packetstormsecurity.com/files/135457/Ipswitch-MOVEit-DMZ-8.1-Authorization-Bypass.htmlExploit
- http://seclists.org/fulldisclosure/2016/Jan/95
- https://www.profundis-labs.com/advisories/CVE-2015-7675.txtExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.