MOVEit Transfer Group Admin Privilege Escalation
CVE-2023-6218

7.2HIGH

Key Information:

Vendor
Progress Software
Status
MOVEit Transfer
Vendor
CVE Published:
29 November 2023

Summary

In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified.  It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.

Affected Version(s)

MOVEit Transfer 2023.1.0(15.1.0)

MOVEit Transfer 2023.0.0 (15.0.0) < 2023.0.7 (15.0.7)

MOVEit Transfer 2022.1.0 (14.1.0) < 2022.1.10 (14.1.10)

References

https://www.progress.com/moveit
product
https://community.progress.com/s/article/MOVEit-Transfer-...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.