Log in Start free

Vulnerability · Published Sep 20, 2023 · Assigned by ProgressSoftware

CVE-2023-42656MOVEit Transfer Reflected XSS

Medium 6.1

In plain English

A medium-severity cross-site scripting in MOVEit Transfer from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.6%top 53.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface.  An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure.  If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.

Affected products (as reported)

VendorProductVersions
Progress Software Corporation MOVEit Transfer 2023.0.0 (15.0.0) – before 2023.0.6 (15.0.6)2022.1.0 (14.1.0) – before 2022.1.9 (14.1.9)2022.0.0 (14.0.0) – before 2022.0.8 (14.0.8)2021.1.0 (13.1.0) – before 2021.1.8 (13.1.8)

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References