QID 378591

Date Published: 2023-06-16

QID 378591: IpSwitch MOVEit Transfer Privilege Escalation and Potential Unauthorized Access Vulnerability

Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted below in order to help protect your MOVEit Transfer environment.

QID Detection Logic: (Authenticated)
This QID checks file version of MOVEit.DMZ.ClassLib.dll to identify the vulnerable versions of the product MOVEit Transfer.

Successful exploitation will lead to privilege escalation and potential unauthorized access

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as Critical - 10 severity.
    • Solution
    Currently there is no fix for the vulnerability.

    Workaround:
    Disable all HTTP and HTTPs traffic to your MOVEit Transfer environment. More specifically:

    Modify firewall rules to deny HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443.
    It is important to note that until HTTP and HTTPS traffic is enabled again:
    Users will not be able to log on to the MOVEit Transfer web UI
    MOVEit Automation tasks that use the native MOVEit Transfer host will not work
    REST, Java and .NET APIs will not work
    MOVEit Transfer add-in for Outlook will not work
    SFTP and FTP/s protocols will continue to work as normal

    Vendor References

    CVEs related to QID 378591

    CVE-2023-35708 |
    Software Advisories
    Advisory ID Software Component Link
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].