PT-2020-13198 · Progress · Moveit Automation Web Admin

Published 2020-05-14 · Updated 2020-05-19 · CVE-2020-12677

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Progress MOVEit Automation Web Admin versions 2018 through 2018.0 prior to 2018.0.3 Progress MOVEit Automation Web Admin versions 2018 SP1 through 2018.2 prior to 2018.2.3 Progress MOVEit Automation Web Admin versions 2018 SP2 through 2018.3 prior to 2018.3.7 Progress MOVEit Automation Web Admin versions 2019 through 2019.0 prior to 2019.0.3 Progress MOVEit Automation Web Admin versions 2019.1 prior to 2019.1.2 Progress MOVEit Automation Web Admin versions 2019.2 prior to 2019.2.2

Description An issue was discovered in Progress MOVEit Automation Web Admin where a Web Admin application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, also known as a cross-site scripting (XSS) attack.

Recommendations For versions 2018 through 2018.0 prior to 2018.0.3, update to version 2018.0.3 or later. For versions 2018 SP1 through 2018.2 prior to 2018.2.3, update to version 2018.2.3 or later. For versions 2018 SP2 through 2018.3 prior to 2018.3.7, update to version 2018.3.7 or later. For versions 2019 through 2019.0 prior to 2019.0.3, update to version 2019.0.3 or later. For versions 2019.1 prior to 2019.1.2, update to version 2019.1.2 or later. For versions 2019.2 prior to 2019.2.2, update to version 2019.2.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-12677

Affected Products

Moveit Automation Web Admin

References · 10

• https://docs.ipswitch.com/MOVEit/Automation2018/ReleaseNotes/en/index.htm#33958.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12677 · Security Note
• https://docs.ipswitch.com/MOVEit/Automation2019_1/ReleaseNotes/en/index.htm#33958.htm · Vendor Advisory
• https://community.progress.com/s/article/MOVEit-Automation-Cross-Site-Scripting-Vulnerability-XSS-May-2020 · Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Automation2018SP1/ReleaseNotes/en/index.htm#33958.htm · Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Automation2019/ReleaseNotes/en/index.htm#33958.htm · Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Automation2019_2/ReleaseNotes/en/index.htm#33958.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12677 · Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Automation2018SP2/ReleaseNotes/en/index.htm#33958.htm · Vendor Advisory
• https://t.me/cvenotify/3805 · Telegram Post