7.5
CVE-2025-11235
- EPSS 0.04%
- Veröffentlicht 06.01.2026 22:16:48
- Zuletzt bearbeitet 03.02.2026 16:54:25
- Quelle security@progress.com
- CVE-Watchlists
- Unerledigt
MOVEit Transfer REST API does not require current password in order to initiate the password change process
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Progress ≫ Moveit Transfer Version >= 2022.0.0 < 2022.0.10
Progress ≫ Moveit Transfer Version >= 2022.1.0 < 2022.1.11
Progress ≫ Moveit Transfer Version >= 2023.0.0 < 2023.0.8
Progress ≫ Moveit Transfer Version >= 2023.1.0 < 2023.1.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.117 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| security@progress.com | 3.7 | 2.2 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
|
CWE-620 Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.