CVE-2024-0396 - Missing Server-Side Input Validation in HTTP Parameter

Back Back to CVE browser

HIGH

Missing Server-Side Input Validation in HTTP Parameter

Published Jan 17, 2024

7.1

HIGH

CVSS 3.1

EPSS 0.54%

Description

In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service.

Affected products

Vendor Progress Software Corporation Product MOVEit Transfer Default
affected
- Version
  2022.0.0 (14.0.0)
  Status
  affected
  Constraints
  <2022.0.10 (14.0.10)
- Version
  2022.1.0 (14.1.0)
  Status
  affected
  Constraints
  <2022.1.11 (14.1.11)
- Version
  2023.0.0 (15.0.0)
  Status
  affected
  Constraints
  <2023.0.8 (15.0.8)
- Version
  2023.1.0 (15.1.0)
  Status
  affected
  Constraints
  <2023.1.3 (15.1.3)

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress Software Corporation

MOVEit Transfer

affected

Version	Status	Constraints
2022.0.0 (14.0.0)	affected	<2022.0.10 (14.0.10)
2022.1.0 (14.1.0)	affected	<2022.1.11 (14.1.11)
2023.0.0 (15.0.0)	affected	<2023.0.8 (15.0.8)
2023.1.0 (15.1.0)	affected	<2023.1.3 (15.1.3)

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (2)

https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-January-2024
vendor-advisoryVendor Advisory
https://www.progress.com/moveit
product

Link	Providers	Tags
https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-January-2024		vendor-advisoryVendor Advisory
https://www.progress.com/moveit		product