What’s Vulnerable › Vulnerabilities

CVE-2017-6195

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-05-18 · updated 2026-06-17
• Weakness: CWE-89

Description

Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20.

Affected products

• Ipswitch Moveit Dmz: through 8.1; 8.2, 8.3
• Ipswitch Moveit Transfer 2017: 9.0

References

• http://ft.ipswitch.com/rs/751-HBN-596/images/Ipswitch-Security-Bulletin-FT-Vulnerability.pdf
• https://www.siberas.de/assets/papers/ssa-1705_IPSWITCH_SQLinjection.txt
• http://ft.ipswitch.com/rs/751-HBN-596/images/Ipswitch-Security-Bulletin-FT-Vulnerability.pdf
• https://www.siberas.de/assets/papers/ssa-1705_IPSWITCH_SQLinjection.txt

Get alerted when CVE-2017-6195 or the next vulnerability affects your stack