PT-2020-17024 · Ipswitch · Moveit Transfer

Mark Galea · Published 2020-11-17 · Updated 2022-10-21 · CVE-2020-28647

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2020.1

Description A malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser, resulting in a cross-site scripting (XSS) attack.

Recommendations For versions prior to 2020.1, update to version 2020.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the application to minimize the risk of exploitation. Avoid interacting with potentially malicious payloads within the MOVEit Transfer instance until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-28647

Affected Products

Moveit Transfer

References · 7

• 🔥 https://labs.secforce.com/posts/progress-moveit-transfer-2020.1-stored-xss-cve-2020-28647 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28647 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28647 · Vendor Advisory
• https://progress.com · Vendor Advisory
• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-Nov-2020 · Vendor Advisory
• https://t.me/cibsecurity/16438 · Telegram Post
• https://t.me/cvenotify/5701 · Telegram Post