CVE-2024-0396highCWE-20

CVE-2024-0396: falha de alta gravidade em Progress Software Corporation MOVEit Transfer

Missing Server-Side Input Validation in HTTP Parameter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar MOVEit Transfer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.5%
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
Progress Software Corporation · MOVEit Transfer
CVEs relacionadas — Progress Software Corporation MOVEit Transfer

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6218HIGHMOVEit Transfer Group Admin Privilege EscalationEPSS 0.7%CVE-2023-42660HIGHMOVEit Transfer Machine Interface SQL InjectionEPSS 0.7%CVE-2023-40043HIGHMOVEit Transfer System Administrator SQL InjectionEPSS 0.7%CVE-2023-42656MEDIUMMOVEit Transfer Reflected XSSEPSS 0.6%CVE-2023-6217HIGHMOVEit Transfer XSS via MOVEit GatewayEPSS 0.5%