2 lines
4.3 KiB
JSON
2 lines
4.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"MOVEit Transfer","vendor":"Progress Software","versions":[{"lessThan":"2022.0.11 (14.0.11)","status":"affected","version":"2022.0.0 (14.0.0)","versionType":"semver"},{"lessThan":"2022.1.12 (14.1.12)","status":"affected","version":"2022.1.0 (14.1.0)","versionType":"semver"},{"lessThan":"2023.0.9 (15.0.9)","status":"affected","version":"2023.0.0 (15.0.0)","versionType":"semver"},{"lessThan":"2023.1.4 (15.1.4)","status":"affected","version":"2023.1.0 (15.1.0)","versionType":"semver"}]}],"source":"security@progress.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*","matchCriteriaId":"A33F43C2-F905-43C3-A9D4-671BEE079C68","versionEndExcluding":"2022.0.11","vulnerable":true},{"criteria":"cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*","matchCriteriaId":"2BD95EE0-833F-42E9-BCCA-EC4089AB6E62","versionEndExcluding":"2022.1.12","versionStartIncluding":"2022.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*","matchCriteriaId":"D682546D-079E-431A-BFA9-DEF714BA364A","versionEndExcluding":"2023.0.9","versionStartIncluding":"2023.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*","matchCriteriaId":"E72FDB08-3760-4472-A60C-BDDD51B25708","versionEndExcluding":"2023.1.4","versionStartIncluding":"2023.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"\nIn Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly."},{"lang":"es","value":"Se ha descubierto una vulnerabilidad de omisión de registro en las versiones de MOVEit Transfer publicadas antes de 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4). Un usuario autenticado podría manipular una solicitud para omitir el mecanismo de registro dentro de la aplicación web, lo que da como resultado que la actividad del usuario no se registre correctamente."}],"id":"CVE-2024-2291","lastModified":"2026-06-17T07:24:15.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@progress.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-2291","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-03-20T20:09:08.372929Z","version":"2.0.3"}}]},"published":"2024-03-20T15:15:08.010","references":[{"source":"security@progress.com","tags":["Vendor Advisory"],"url":"https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024"},{"source":"security@progress.com","tags":["Product"],"url":"https://www.progress.com/moveit"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://www.progress.com/moveit"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-778"}],"source":"security@progress.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
|