Unrated severityNVD Advisory· Published Mar 19, 2025· Updated Mar 19, 2025

A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder

CVE-2025-2324

Description

Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2024.1.0 before 2024.1.2.

Affected products

Ipswitch, Inc./Moveit Transfer 2017llm-fuzzy
Range: >= 2023.1.0 < 2023.1.12 || >= 2024.0.0 < 2024.0.8 || >= 2024.1.0 < 2024.1.2
Progress/MOVEit Transferv5
Range: 2023.1.0

Patches

Vulnerability mechanics

References

community.progress.com/s/article/MOVEit-Transfer-Vulnerability-CVE-2025-2324-March-18-2025mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000