CVE-2020-28647

In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.47% chance of exploitation in the next 30 days, 73rd percentile

Published

2020-11-17

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://labs.secforce.com/posts/progress-moveit-transfer-2020.1-stored-xss-cve-2020-28647/
• SECFORCE/Progress-MOVEit-Transfer-2020.1-Stored-XSS-CVE-2020-286470★ · 2020-12-17

Security advisories

• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-Nov-2020
• https://www.progress.com
• https://labs.secforce.com/posts/progress-moveit-transfer-2020.1-stored-xss-cve-2020-28647

References

• CVE Record
• NVD entry

Related

• CVE-2008-1613
• CVE-2008-5416
• CVE-2011-3368
• CVE-2011-4107
• CVE-2017-3599
• CVE-2018-8941