PT-2024-19605 · Ipswitch · Moveit Transfer

Hackerone: Interl0Per · Published 2024-03-20 · Updated 2025-01-16 · CVE-2024-2291

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2022.0.11 (14.0.11) MOVEit Transfer versions prior to 2022.1.12 (14.1.12) MOVEit Transfer versions prior to 2023.0.9 (15.0.9) MOVEit Transfer versions prior to 2023.1.4 (15.1.4)

Description A logging bypass issue has been discovered, allowing an authenticated user to manipulate a request and bypass the logging mechanism within the web application. This results in user activity not being logged properly.

Recommendations For versions prior to 2022.0.11 (14.0.11), update to version 2022.0.11 (14.0.11) or later. For versions prior to 2022.1.12 (14.1.12), update to version 2022.1.12 (14.1.12) or later. For versions prior to 2023.0.9 (15.0.9), update to version 2023.0.9 (15.0.9) or later. For versions prior to 2023.1.4 (15.1.4), update to version 2023.1.4 (15.1.4) or later.

Fix

Weakness Enumeration

CWE-778

Related Identifiers

CVE-2024-2291

Affected Products

Moveit Transfer

References · 5

• https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2291 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2291 · Vendor Advisory
• https://progress.com/moveit · Note
• https://twitter.com/pfiatde/status/1801521460407611800 · Twitter Post