MOVEit Transfer Group Admin Privilege Escalation
CVE-2023-6218

7.2HIGH

Key Information:

Vendor
Progress Software
Status
MOVEit Transfer
Vendor
CVE Published:
29 November 2023

Summary

A privilege escalation vulnerability has been identified in MOVEit Transfer, affecting versions prior to 2022.0.9, 2022.1.10, and 2023.0.7. This flaw allows a group administrator to elevate the permissions of a group member, granting them the capabilities of an organization administrator. This opens up potential unauthorized access and control over sensitive data within the organization. It is crucial for users to upgrade to the latest versions to mitigate risks associated with this vulnerability.

Affected Version(s)

MOVEit Transfer 2023.1.0(15.1.0)

MOVEit Transfer 2023.0.0 (15.0.0) < 2023.0.7 (15.0.7)

MOVEit Transfer 2022.1.0 (14.1.0) < 2022.1.10 (14.1.10)

References

https://www.progress.com/moveit
product
https://community.progress.com/s/article/MOVEit-Transfer-...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.