VulnerabilityModified
CVE-2015-7676
Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading HTML files.
MEDIUM 5.4EPSS 1.78%
Does this matter?
Lower severity and a low EPSS score (1.78%). Track it; it rarely justifies an emergency change on its own.
Description
Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading HTML files.
- CVSS 3.0
- 5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.78% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ipswitch/moveit dmz
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/135458/Ipswitch-MOVEit-DMZ-8.1-Persistent-Cross-Site-Scripting.htmlExploit
- http://seclists.org/fulldisclosure/2016/Jan/95
- http://www.securityfocus.com/bid/90574
- https://profundis-labs.com/advisories/CVE-2015-7676.txtExploit
- http://packetstormsecurity.com/files/135458/Ipswitch-MOVEit-DMZ-8.1-Persistent-Cross-Site-Scripting.htmlExploit
- http://seclists.org/fulldisclosure/2016/Jan/95
- http://www.securityfocus.com/bid/90574
- https://profundis-labs.com/advisories/CVE-2015-7676.txtExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.