High severity · published Jan 17, 2024
CVE-2024-0396
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
MOVEit Transfer · Progress
before 2022.0.10; 2022.1.0 before 2022.1.11; 2023.0.1 before 2023.0.8; 2023.1.0 before 2023.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0396
Vendor Advisory
https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-January-2024
Product
https://www.progress.com/moveit
More from MOVEit Transfer
9.8
CVE-2023-34362
Progress MOVEit Transfer SQL Injection Vulnerability
9.8
CVE-2026-89073
MOVEit Transfer Access restriction bypass in OAuth authentication
9.8
CVE-2026-89068
MOVEit Transfer Authentication bypass in LDAP sign-on
9.8
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce updated account restrictions
9.8
CVE-2026-15966
Improper CORS handling in MOVEit Transfer