Missing Server-Side Input Validation in HTTP Parameter
CVE-2024-0396

7.1HIGH

Key Information:

Vendor
Progress Software
Status
MOVEit Transfer
Vendor
CVE Published:
17 January 2024

Summary

An input validation vulnerability has been identified in certain versions of MOVEit Transfer, where an authenticated user can manipulate parameters during an HTTPS transaction. This manipulation could initiate computational errors within the system and may lead to unintended denial of service. The affected versions include those released before 2022.0.10, 2022.1.11, 2023.0.8, and 2023.1.3, which require immediate patching to mitigate these potential risks. Organizations using these versions should prioritize updates to enhance their security posture.

Affected Version(s)

MOVEit Transfer 2022.0.0 (14.0.0)

MOVEit Transfer 2022.0.0 (14.0.0) < 2022.0.10 (14.0.10)

MOVEit Transfer 2022.1.0 (14.1.0) < 2022.1.11 (14.1.11)

References

https://www.progress.com/moveit
product
https://community.progress.com/s/article/MOVEit-Transfer-...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

HackerOne: p-v-p
.