CVE-2023-6217: MOVEit Transfer XSS via MOVEit Gateway
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer.
An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-6217?
CVE-2023-6217 is a vulnerability that allows for reflected cross-site scripting (XSS) attacks in MOVEit Transfer when used with MOVEit Gateway.
What is the severity of CVE-2023-6217?
The severity of CVE-2023-6217 is high, with a CVSS score of 7.1.
How does CVE-2023-6217 affect MOVEit Transfer?
CVE-2023-6217 affects MOVEit Transfer versions released before 2022.0.9, 2022.1.10, and 2023.0.7.
How can an attacker exploit CVE-2023-6217?
An attacker can exploit CVE-2023-6217 by crafting a malicious payload and tricking a user into clicking on a specially crafted link.
Where can I find more information about CVE-2023-6217?
You can find more information about CVE-2023-6217 on the Progress MOVEit website and the Progress Community website.