CVE-2023-6217highCWE-79

CVE-2023-6217: falha de alta gravidade em Progress Software Corporation MOVEit Transfer

MOVEit Transfer XSS via MOVEit Gateway

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar MOVEit Transfer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.5%
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer.  An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Produtos afetados
Progress Software Corporation · MOVEit Transfer
CVEs relacionadas — Progress Software Corporation MOVEit Transfer

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6218HIGHMOVEit Transfer Group Admin Privilege EscalationEPSS 0.7%CVE-2023-42660HIGHMOVEit Transfer Machine Interface SQL InjectionEPSS 0.7%CVE-2023-40043HIGHMOVEit Transfer System Administrator SQL InjectionEPSS 0.7%CVE-2023-42656MEDIUMMOVEit Transfer Reflected XSSEPSS 0.6%CVE-2024-0396HIGHMissing Server-Side Input Validation in HTTP ParameterEPSS 0.5%