Log in Start free

Vulnerability · Published Nov 29, 2023 · Assigned by ProgressSoftware

CVE-2023-6217MOVEit Transfer XSS via MOVEit Gateway

High 7.1

In plain English

A high-severity cross-site scripting in MOVEit Transfer from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 56.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer.  An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser.

Affected products (as reported)

VendorProductVersions
Progress Software Corporation MOVEit Transfer 2023.0.0 (15.0.0) – before 2023.0.7 (15.0.7)2022.1.0 (14.1.0) – before 2022.1.10 (14.1.10)2022.0.0 (14.0.0) – before 2022.0.9 (14.0.9)

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References