Sign-up

ID

VAR-201602-0292


CVE

CVE-2015-7677


TITLE

Ipswitch MOVEit DMZ of MOVEitISAPI In service FileID Enumerated vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-006866

DESCRIPTION

The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll. Ipswitch MOVEit is an automated file transfer system from Ipswitch Corporation in the United States. The system supports control, management, and visibility into all business-critical file transfer activities through a single, secure system. DMZ is one version of this. There is a security vulnerability in the MOVEitISAPI service of Ipswitch MOVEit DMZ 8.1 and earlier versions. A remote attacker can exploit this vulnerability to enumerate FileIDs by using the 'X-siLock-FileID' parameter in the download operation of the MOVEitISAPI/MOVEitISAPI.dll file

Trust: 1.8

sources: NVD: CVE-2015-7677 // JVNDB: JVNDB-2015-006866 // VULHUB: VHN-85638 // VULMON: CVE-2015-7677

AFFECTED PRODUCTS

vendor:ipswitchmodel:moveit dmzscope:lteversion:8.1

Trust: 1.0

vendor:ipswitchmodel:moveit dmzscope:ltversion:8.2

Trust: 0.8

vendor:ipswitchmodel:moveit dmzscope:eqversion:8.1

Trust: 0.6

sources: JVNDB: JVNDB-2015-006866 // CNNVD: CNNVD-201602-208 // NVD: CVE-2015-7677

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-7677
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-7677
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201602-208
value: MEDIUM

Trust: 0.6

VULHUB: VHN-85638
value: MEDIUM

Trust: 0.1

VULMON: CVE-2015-7677
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-7677
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-85638
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-7677
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.0

Trust: 1.0

sources: VULHUB: VHN-85638 // VULMON: CVE-2015-7677 // JVNDB: JVNDB-2015-006866 // CNNVD: CNNVD-201602-208 // NVD: CVE-2015-7677

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-85638 // JVNDB: JVNDB-2015-006866 // NVD: CVE-2015-7677

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201602-208

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201602-208

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006866

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-85638

PATCH
title:MOVEit DMZ Release Notes 8.2url:http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf
Trust: 0.8
title:Ipswitch MOVEit DMZ MOVEitISAPI Repair measures for service information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60151
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2015-006866 // 
            
            
            
            CNNVD: CNNVD-201602-208

EXTERNAL IDS
db:NVDid:CVE-2015-7677
Trust: 2.6
db:PACKETSTORMid:135459
Trust: 1.8
db:JVNDBid:JVNDB-2015-006866
Trust: 0.8
db:CNNVDid:CNNVD-201602-208
Trust: 0.7
db:VULHUBid:VHN-85638
Trust: 0.1
db:PACKETSTORMid:135457
Trust: 0.1
db:VULMONid:CVE-2015-7677
Trust: 0.1
sources:
            
            
            VULHUB: VHN-85638 // 
            
            
            
            VULMON: CVE-2015-7677 // 
            
            
            
            JVNDB: JVNDB-2015-006866 // 
            
            
            
            CNNVD: CNNVD-201602-208 // 
            
            
            
            NVD: CVE-2015-7677

REFERENCES
url:http://docs.ipswitch.com/moveit/dmz82/releasenotes/moveitreleasenotes82.pdf
Trust: 1.8
url:http://seclists.org/fulldisclosure/2016/jan/95
Trust: 1.8
url:http://packetstormsecurity.com/files/135459/ipswitch-moveit-dmz-8.1-file-id-enumeration.html
Trust: 1.8
url:https://www.profundis-labs.com/advisories/cve-2015-7677.txt
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7677
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7677
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/200.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://packetstormsecurity.com/files/135457/ipswitch-moveit-dmz-8.1-authorization-bypass.html
Trust: 0.1
sources:
            
            
            VULHUB: VHN-85638 // 
            
            
            
            VULMON: CVE-2015-7677 // 
            
            
            
            JVNDB: JVNDB-2015-006866 // 
            
            
            
            CNNVD: CNNVD-201602-208 // 
            
            
            
            NVD: CVE-2015-7677

SOURCES
db:VULHUBid:VHN-85638
db:VULMONid:CVE-2015-7677
db:JVNDBid:JVNDB-2015-006866
db:CNNVDid:CNNVD-201602-208
db:NVDid:CVE-2015-7677

LAST UPDATE DATE
2025-04-13T23:23:41.267000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-85638date:2016-02-12T00:00:00
db:VULMONid:CVE-2015-7677date:2016-02-12T00:00:00
db:JVNDBid:JVNDB-2015-006866date:2016-02-15T00:00:00
db:CNNVDid:CNNVD-201602-208date:2016-02-15T00:00:00
db:NVDid:CVE-2015-7677date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-85638date:2016-02-10T00:00:00
db:VULMONid:CVE-2015-7677date:2016-02-10T00:00:00
db:JVNDBid:JVNDB-2015-006866date:2016-02-15T00:00:00
db:CNNVDid:CNNVD-201602-208date:2016-02-15T00:00:00
db:NVDid:CVE-2015-7677date:2016-02-10T15:59:01.350