Progress Software Corporation Vulnerabilities and Affected Products
Vulnerabilities associated with MOVEit Transfer.
Products
Clear product- WhatsUp Gold42 vulnerabilities
- WS_FTP Server11 vulnerabilities
- MarkLogic Server10 vulnerabilities
- Sitefinity7 vulnerabilities
- Telerik Report Server7 vulnerabilities
- MOVEit Transfer6 vulnerabilities
- OpenEdge5 vulnerabilities
- Telerik Reporting5 vulnerabilities
- LoadMaster2 vulnerabilities
- Chef Automate1 vulnerability
- Chef Habitat Builder1 vulnerability
- Chef InSpec1 vulnerability
- MOVEit Automation1 vulnerability
- Progress® Telerik® Reporting1 vulnerability
- Telerik UI for WinForms1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-0396HIGH | Missing Server-Side Input Validation in HTTP ParameterIn Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service. CWE-20Jan 17, 2024 | CVSS7.1v3.1 | EPSS0.539% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-6218HIGH | MOVEit Transfer Group Admin Privilege EscalationIn Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator. CWE-269Nov 29, 2023 | CVSS7.2v3.1 | EPSS0.696% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-6217HIGH | MOVEit Transfer XSS via MOVEit GatewayIn Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript with… CWE-79Nov 29, 2023 | CVSS7.1v3.1 | EPSS0.511% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-42656MEDIUM | MOVEit Transfer Reflected XSSIn Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the vict… CWE-79Sep 20, 2023 | CVSS6.1v3.1 | EPSS0.481% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-40043HIGH | MOVEit Transfer System Administrator SQL InjectionIn Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database… CWE-89Sep 20, 2023 | CVSS7.2v3.1 | EPSS0.561% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-42660HIGH | MOVEit Transfer Machine Interface SQL InjectionIn Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content. CWE-89Sep 20, 2023 | CVSS8.8v3.1 | EPSS0.577% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |