7.2

CVE-2023-6218

In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified.  It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.

Data is provided by the National Vulnerability Database (NVD)
Progress ≫ Moveit Transfer Version <= 2021.1.0
Progress ≫ Moveit Transfer Version >= 2022.0.0 < 2022.0.9
Progress ≫ Moveit Transfer Version >= 2022.1.0 < 2022.1.10
Progress ≫ Moveit Transfer Version >= 2023.0.0 < 2023.0.7
Progress ≫ Moveit Transfer Version >= 2023.1.0 < 2023.1.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.264
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
security@progress.com 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.