CVE-2023-42656
published 2023-09-20CVE-2023-42656: In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.48%
37.9th percentile
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress | moveit_transfer | < 2021.1.8 | 2021.1.8 |
| progress | moveit_transfer | >= 2022.0.0 < 2022.0.8 | 2022.0.8 |
| progress | moveit_transfer | >= 2022.1.0 < 2022.1.9 | 2022.1.9 |
| progress | moveit_transfer | >= 2023.0.0 < 2023.0.6 | 2023.0.6 |
| progress_software_corporation | moveit_transfer | >= 2021.1.0 (13.1.0) < 2021.1.8 (13.1.8) | 2021.1.8 (13.1.8) |
| progress_software_corporation | moveit_transfer | >= 2022.0.0 (14.0.0) < 2022.0.8 (14.0.8) | 2022.0.8 (14.0.8) |
| progress_software_corporation | moveit_transfer | >= 2022.1.0 (14.1.0) < 2022.1.9 (14.1.9) | 2022.1.9 (14.1.9) |
| progress_software_corporation | moveit_transfer | >= 2023.0.0 (15.0.0) < 2023.0.6 (15.0.6) | 2023.0.6 (15.0.6) |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-09-20
Published