CVE-2024-0396
HIGHProgress MOVEit Transfer < 2022.0.10, 2022.1.11, 2023.0.8, 2023.1.3 - DoS via HTTPS Parameter Manipulation
Title source: llmDescription
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service.
References (2)
Core 2
Core References
Product product
https://www.progress.com/moveit
Vendor Advisory vendor-advisory
https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-January-2024
Scores
CVSS v3
7.1
EPSS
0.0016
EPSS Percentile
36.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-20
Status
published
Products (1)
progress/moveit_transfer
< 2022.0.10
Published
Jan 17, 2024
Tracked Since
Feb 18, 2026