CVE-2025-11235

LOW

Progress MOVEit Transfer <2023.1.3-2022.0.10 - Unverified Password ...

Title source: llm

Description

Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

References (1)

[Release Notes] https://docs.progress.com/bundle/moveit-transfer-release-notes-2023_1/page/Fixed-Issues-in-2023.1.3.html

Scores

CVSS v3 3.7

EPSS 0.0003

EPSS Percentile 7.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-620

Status published

Products (1)

progress/moveit_transfer 2022.0.0 - 2022.0.10

Published Jan 07, 2026

Tracked Since Feb 18, 2026