CVE-2015-7680

CVE Database · CVE-2015-7680

CVE-2015-7680

· N/AModified

CVSS v3.1

N/A

EPSS

2.15%

Published

Feb 10, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx.

Weaknesses (CWE)

CWE-200

Affected Products (1)

ipswitch · moveit_dmzvulnerable

References (8)

http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf

Vendor Advisory

http://packetstormsecurity.com/files/135462/Ipswitch-MOVEit-DMZ-8.1-Information-Disclosure.html

Exploit

http://seclists.org/fulldisclosure/2016/Jan/95

https://profundis-labs.com/advisories/CVE-2015-7680.txt

Exploit

http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf

Vendor Advisory

http://packetstormsecurity.com/files/135462/Ipswitch-MOVEit-DMZ-8.1-Information-Disclosure.html

Exploit

http://seclists.org/fulldisclosure/2016/Jan/95

KEV Catalog EPSS Scores Vendors All CVEs