CVE-2023-42656: MOVEit Transfer Reflected XSS
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-42656?
CVE-2023-42656 is a reflected cross-site scripting (XSS) vulnerability found in MOVEit Transfer's web interface.
Which versions of MOVEit Transfer are affected by CVE-2023-42656?
MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), and 2023.0.6 (15.0.6) are affected by CVE-2023-42656.
What is the severity of CVE-2023-42656?
The severity of CVE-2023-42656 is medium with a score of 6.1.
How can an attacker exploit CVE-2023-42656?
An attacker can exploit CVE-2023-42656 by crafting a malicious payload and targeting MOVEit Transfer's web interface.
How can I mitigate the vulnerability in MOVEit Transfer?
To mitigate the vulnerability in MOVEit Transfer, update to version 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), or 2023.0.6 (15.0.6) or later.