Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-2291

In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.

Published

2024-03-20T15:15:08.010

Last Modified

2025-01-16T18:02:45.747

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

Weaknesses

Type: Secondary
CWE-778
Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	progress	moveit_transfer	< 2022.0.11	Yes
Application	progress	moveit_transfer	< 2022.1.12	Yes
Application	progress	moveit_transfer	< 2023.0.9	Yes
Application	progress	moveit_transfer	< 2023.1.4	Yes

References

https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024 Vendor Advisory ([email protected])
https://www.progress.com/moveit Product ([email protected])
https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.progress.com/moveit Product (af854a3a-2127-422b-91ae-364da2661108)