CVE-2024-2291

In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024	Vendor Advisory
https://www.progress.com/moveit	Product
https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024	Vendor Advisory
https://www.progress.com/moveit	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::

History

No history.

Information

Published : 2024-03-20 15:15

Updated : 2025-01-16 18:02

NVD link : CVE-2024-2291

Mitre link : CVE-2024-2291

CVE.ORG link : CVE-2024-2291

JSON object : View

Products Affected

progress

moveit_transfer

CWE

CWE-778

Insufficient Logging

NVD-CWE-Other

{"id": "CVE-2024-2291", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-03-20T15:15:08.010", "references": [{"url": "https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.progress.com/moveit", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.progress.com/moveit", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-778"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "\nIn Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered.\u00a0 An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad de omisi\u00f3n de registro en las versiones de MOVEit Transfer publicadas antes de 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4). Un usuario autenticado podr\u00eda manipular una solicitud para omitir el mecanismo de registro dentro de la aplicaci\u00f3n web, lo que da como resultado que la actividad del usuario no se registre correctamente."}], "lastModified": "2025-01-16T18:02:45.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A33F43C2-F905-43C3-A9D4-671BEE079C68", "versionEndExcluding": "2022.0.11"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BD95EE0-833F-42E9-BCCA-EC4089AB6E62", "versionEndExcluding": "2022.1.12", "versionStartIncluding": "2022.1.0"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D682546D-079E-431A-BFA9-DEF714BA364A", "versionEndExcluding": "2023.0.9", "versionStartIncluding": "2023.0.0"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E72FDB08-3760-4472-A60C-BDDD51B25708", "versionEndExcluding": "2023.1.4", "versionStartIncluding": "2023.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}