PT-2025-47528 · Progress · Moveit Transfer

Alex Achs + 3 · Published 2025-11-15 · Updated 2025-11-21 · CVE-2025-13147

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Progress MOVEit Transfer versions prior to 2024.1.8 Progress MOVEit Transfer versions 2025.0.0 through 2025.0.3

Description A Server-Side Request Forgery (SSRF) vulnerability exists in Progress MOVEit Transfer. This type of issue allows an attacker to make requests on behalf of the server, potentially accessing internal resources or performing actions with the server's privileges.

Recommendations Update Progress MOVEit Transfer to version 2024.1.8 or later. Update Progress MOVEit Transfer to version 2025.0.4 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-02088

CVE-2025-13147

Affected Products

Moveit Transfer

References · 9

• https://bdu.fstec.ru/vul/2026-02088 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-13147 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13147 · Vendor Advisory
• https://docs.progress.com/bundle/moveit-transfer-release-notes-2025/page/Fixed-Issues-in-2025.0.4.html · Note
• https://docs.progress.com/bundle/moveit-transfer-release-notes-2025_1/page/Fixed-Issues-in-2025.1.html · Note
• https://t.me/cveNotify/143584 · Telegram Post
• https://docs.progress.com/bundle/moveit-transfer-release-notes-2024/page/Fixed-Issues-in-2024.1.8.html · Note
• https://twitter.com/CVEnew/status/1991409462045712489 · Twitter Post
• https://t.me/CVEtracker/37786 · Telegram Post