Login Request a demo
Medium severity · published Apr 15, 2016
CVE-2015-7676
Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cross-site scripting…
5.4
CVSS
1.8%
EPSS
No
On KEV
Description
Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading HTML files.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Moveit Dmz · Ipswitch
through 8.1 · source: NVD
Affected product
MD
Moveit Dmz
Ipswitch
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7676
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7676
Exploit
http://packetstormsecurity.com/files/135458/Ipswitch-MOVEit-DMZ-8.1-Persistent-Cross-Site-Scripting.html
seclists.org
http://seclists.org/fulldisclosure/2016/Jan/95
www.securityfocus.com
http://www.securityfocus.com/bid/90574
Exploit
https://profundis-labs.com/advisories/CVE-2015-7676.txt
More from Moveit Dmz
9.8
CVE-2017-6195
Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection
6.5
CVE-2015-7675
The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files…
5.3
CVE-2015-7680
Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to…
4.3
CVE-2015-7677
The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to…