Lucene search

ProgressSoftwareCVE-2023-42656

HistorySep 20, 2023 - 5:15 p.m.

CVE-2023-42656

2023-09-2017:15:11

CWE-79

ProgressSoftware

web.nvd.nist.gov

cve-2023-42656

moveit transfer

xss

security vulnerability

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer’s web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.

Affected configurations

Nvd

Node

progressmoveit_transferRange<2021.1.8

progressmoveit_transferRange2022.0.0–2022.0.8

progressmoveit_transferRange2022.1.0–2022.1.9

progressmoveit_transferRange2023.0.0–2023.0.6

VendorProductVersionCPE
progressmoveit_transfer*cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
progress	moveit_transfer	*	cpe:2.3:a:progress:moveit_transfer::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "MOVEit Transfer Web Interface"
    ],
    "product": "MOVEit Transfer",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "2023.0.6 (15.0.6)",
        "status": "affected",
        "version": "2023.0.0 (15.0.0)",
        "versionType": "semver"
      },
      {
        "lessThan": "2022.1.9 (14.1.9)",
        "status": "affected",
        "version": "2022.1.0 (14.1.0)",
        "versionType": "semver"
      },
      {
        "lessThan": "2022.0.8 (14.0.8)",
        "status": "affected",
        "version": "2022.0.0 (14.0.0)",
        "versionType": "semver"
      },
      {
        "lessThan": "2021.1.8 (13.1.8)",
        "status": "affected",
        "version": "2021.1.0 (13.1.0)",
        "versionType": "semver"
      }
    ]
  }
]

References

community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023

www.progress.com/moveit

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

Related for CVE-2023-42656