High severity · published Feb 14, 2020
CVE-2020-8611
In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an…
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
MOVEit Transfer · Progress
2019.2 before 2019.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8611
Vendor Advisory
https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020
Release Notes
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm
Release Notes
https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm
Product
https://status.moveitcloud.com/
More from MOVEit Transfer
9.8
CVE-2023-34362
Progress MOVEit Transfer SQL Injection Vulnerability
9.8
CVE-2026-89073
MOVEit Transfer Access restriction bypass in OAuth authentication
9.8
CVE-2026-89068
MOVEit Transfer Authentication bypass in LDAP sign-on
9.8
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce updated account restrictions
9.8
CVE-2026-15966
Improper CORS handling in MOVEit Transfer