QID 379539

Date Published: 2024-04-04

QID 379539: Progress MOVEit Transfer logging bypass Vulnerability (March-2024)

In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered.

Affected Versions:
MOVEit Transfer 2023.1.3 (15.1.3) and earlier
MOVEit Transfer 2023.0.8 (15.0.8) and earlier
MOVEit Transfer 2022.1.11 (14.1.11) and earlier
MOVEit Transfer 2022.0.10 (14.0.10) and earlier
MOVEit Transfer 2021.1.x (13.1.x) and older
QID Detection Logic: (Authenticated)
This QID checks file version of MOVEit.DMZ.ClassLib.dll to identify the vulnerable versions of the product MOVEit Transfer.

QID Detection Logic: (Unauthenticated)
This QID checks vulnerable version of MOVEit Transfer by sending a HTTP GET request to '/moveitisapi/moveitisapi.dll?action=capa' endpoint and checking the X-MOVEitISAPI-Version header.

An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.

CVSS V3 rated as Medium - 4.3 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to the article Article 000254362 for more information regarding the vulnerability and its related patches.

Vendor References

MOVEit-Transfer-Service-Pack-March-2024 - community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024

CVEs related to QID 379539

CVE-2024-2291 |

Software Advisories

Advisory ID	Software	Component	Link
MOVEit-Transfer-Service-Pack-March-2024			community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].