Skip to content

Product

Progress Software MOVEit Transfer vulnerabilities

6 published CVES affecting Progress Software MOVEit Transfer, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
6
Critical
0
High
4
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest Progress Software MOVEit Transfer CVEs

Newest publication first

  1. CVE-2024-2291 MOVEit Transfer Logging Bypass Vulnerability

    Published
    MediumCVSS 4.3

    In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web...

  2. CVE-2023-6218 MOVEit Transfer Group Admin Privilege Escalation

    Published
    HighCVSS 7.2

    In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to...

  3. CVE-2023-6217 MOVEit Transfer XSS via MOVEit Gateway

    Published
    HighCVSS 7.1

    In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a mali...

  4. CVE-2023-42656 MOVEit Transfer Reflected XSS

    Published
    MediumCVSS 6.1

    In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payloa...

  5. CVE-2023-40043 MOVEit Transfer System Administrator SQL Injection

    Published
    HighCVSS 7.2

    In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain u...

  6. CVE-2023-42660 MOVEit Transfer Machine Interface SQL Injection

    Published
    HighCVSS 8.8

    In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthori...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.