fkie_cve-2023-6218
Vulnerability from fkie_nvd
Published
2023-11-29 17:15
Modified
2024-11-21 08:43
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.
References
▼ | URL | Tags | |
---|---|---|---|
security@progress.com | https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023 | Release Notes, Vendor Advisory | |
security@progress.com | https://www.progress.com/moveit | Product | |
af854a3a-2127-422b-91ae-364da2661108 | https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023 | Release Notes, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.progress.com/moveit | Product |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
progress | moveit_transfer | * | |
progress | moveit_transfer | * | |
progress | moveit_transfer | * | |
progress | moveit_transfer | * | |
progress | moveit_transfer | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A99606D-C2F1-40F0-B682-8AF3A1214ED7", "versionEndIncluding": "2021.1.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "matchCriteriaId": "6985BD08-92E5-48EA-BB76-B85186F067EA", "versionEndExcluding": "2022.0.9", "versionStartIncluding": "2022.0.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "matchCriteriaId": "7753AA60-D5C5-47A7-AE71-0ED05DE24930", "versionEndExcluding": "2022.1.10", "versionStartIncluding": "2022.1.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "matchCriteriaId": "A01A6CCA-73BC-45BE-858A-24EEA00B81EC", "versionEndExcluding": "2023.0.7", "versionStartIncluding": "2023.0.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B7FB41C-AC16-4A5F-9C0D-CEF3E87084CF", "versionEndExcluding": "2023.1.2", "versionStartIncluding": "2023.1.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "\nIn Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified.\u00a0 It is possible for a group administrator to elevate a group members permissions to the role of an organization\u00a0administrator.\n" }, { "lang": "es", "value": "En las versiones de Progress MOVEit Transfer lanzadas antes de 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), se ha identificado una ruta de escalada de privilegios asociada con los administradores de grupo. Es posible que un administrador de grupo eleve los permisos de los miembros de un grupo al rol de administrador de la organizaci\u00f3n." } ], "id": "CVE-2023-6218", "lastModified": "2024-11-21T08:43:23.390", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@progress.com", "type": "Secondary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2023-11-29T17:15:07.587", "references": [ { "source": "security@progress.com", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023" }, { "source": "security@progress.com", "tags": [ "Product" ], "url": "https://www.progress.com/moveit" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Product" ], "url": "https://www.progress.com/moveit" } ], "sourceIdentifier": "security@progress.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-269" } ], "source": "security@progress.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-269" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.