CVE-2024-0396

In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered.  An authenticated user can manipulate a parameter in an HTTPS transaction.  The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
ProgressSoftwareCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
VendorProductVersion
progressmoveit_transfer
𝑥
< 2022.0.10
progressmoveit_transfer
2022.1.0 ≤
𝑥
< 2022.1.11
progressmoveit_transfer
2023.0.1 ≤
𝑥
< 2023.0.8
progressmoveit_transfer
2023.1.0 ≤
𝑥
< 2023.1.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-January-2024
https://www.progress.com/moveit
https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-January-2024
https://www.progress.com/moveit