CVE-2020-8612 - In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS

Back Back to CVE browser

CRITICAL

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS

Published Feb 14, 2020

9.0

CRITICAL

CVSS 3.1

EPSS 1.67%

Description

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020
x_refsource_MISCPatchVendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm
x_refsource_CONFIRMRelease NotesVendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm
x_refsource_CONFIRMRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29460
Advisory
https://status.moveitcloud.com/
x_refsource_CONFIRMProduct

Link	Providers	Tags
https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020		x_refsource_MISCPatchVendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm		x_refsource_CONFIRMRelease NotesVendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm		x_refsource_CONFIRMRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29460		Advisory
https://status.moveitcloud.com/		x_refsource_CONFIRMProduct