PT-2023-7247 · Ipswitch · Moveit Transfer

Published 2023-11-20 · Updated 2023-12-09 · CVE-2023-6218

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2022.0.9 (14.0.9) MOVEit Transfer versions prior to 2022.1.10 (14.1.10) MOVEit Transfer versions prior to 2023.0.7 (15.0.7)

Description A privilege escalation path associated with group administrators has been identified, allowing a group administrator to elevate a group member's permissions to the role of an organization administrator. The issue is related to insufficient access control in the software.

Recommendations For versions prior to 2022.0.9 (14.0.9), update to a version newer than 2022.0.9 to resolve the issue. For versions prior to 2022.1.10 (14.1.10), update to a version newer than 2022.1.10 to resolve the issue. For versions prior to 2023.0.7 (15.0.7), update to a version newer than 2023.0.7 to resolve the issue. As a temporary workaround, consider restricting the privileges of group administrators to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2023-08275

CVE-2023-6218

Affected Products

Moveit Transfer

References · 8

• https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08275 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-6218 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6218 · Vendor Advisory
• https://t.me/cvenotify/61494 · Telegram Post
• https://progress.com/moveit · Note
• https://twitter.com/fletch_ai/status/1733654520922538135 · Twitter Post
• https://vuldb.com/ru/?id.246369 · Note