CVE-2024-6576 - MOVEit Transfer Privilege Escalation Vulnerability

Back Back to CVE browser

CRITICAL

MOVEit Transfer Privilege Escalation Vulnerability

Published Jul 29, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.62%

Description

Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.

Affected products

Vendor Progress Product MOVEit Transfer Default
unaffected
- Version
  2023.0.0
  Status
  affected
  Constraints
  <2023.0.12
- Version
  2023.1.0
  Status
  affected
  Constraints
  <2023.1.7
- Version
  2024.0.0
  Status
  affected
  Constraints
  <2024.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress

MOVEit Transfer

unaffected

Version	Status	Constraints
2023.0.0	affected	<2023.0.12
2023.1.0	affected	<2023.1.7
2024.0.0	affected	<2024.0.3

Vendor Progress Product Moveit Transfer Default
n/a
- Version
  2023.0.0
  Status
  affected
  Constraints
  <2023.0.12
- Version
  2023.1.0
  Status
  affected
  Constraints
  <2023.1.7
- Version
  2024.0.0
  Status
  affected
  Constraints
  <2024.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress

Moveit Transfer

n/a

Version	Status	Constraints
2023.0.0	affected	<2023.0.12
2023.1.0	affected	<2023.1.7
2024.0.0	affected	<2024.0.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://community.progress.com/s/article/MOVEit-Transfer-Product-Security-Alert-Bulletin-July-2024-CVE-2024-6576
vendor-advisoryVendor Advisory
https://www.progress.com/moveit
product

Link	Providers	Tags
https://community.progress.com/s/article/MOVEit-Transfer-Product-Security-Alert-Bulletin-July-2024-CVE-2024-6576		vendor-advisoryVendor Advisory
https://www.progress.com/moveit		product