Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
MOVEit Transfer Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2020-8611 - Vulnerability Database
MOVEit Transfer

MOVEit Transfer Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2020-8611

High
Reference: CVE-2020-8611
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-8611
Title: MOVEit Transfer Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability
Overview:

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1 multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer39s database via the REST API. Depending on the database engine being used (MySQL Microsoft SQL Server or Azure SQL) an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements.