Unrated severityNVD Advisory· Published Nov 29, 2023· Updated Aug 2, 2024
MOVEit Transfer XSS via MOVEit Gateway
CVE-2023-6217
Description
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer.
An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <2022.0.9 (14.0.9), <2022.1.10 (14.1.10), <2023.0.7 (15.0.7)
- Progress Software Corporation/MOVEit Transferv5Range: 2023.0.0 (15.0.0)
Patches
Vulnerability mechanics
References
2- community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023mitrevendor-advisory
- www.progress.com/moveitmitreproduct
News mentions
0No linked articles in our index yet.