CVE-2025-11235: MOVEit Transfer REST API does not require current password in order to initiate the password change process
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11235?
CVE-2025-11235 is considered a high-severity vulnerability due to its potential for unauthorized password changes.
How do I fix CVE-2025-11235?
To fix CVE-2025-11235, upgrade your Progress MOVEit Transfer installation to version 2023.1.3 or later, or other specified patched versions.
Which versions of MOVEit Transfer are affected by CVE-2025-11235?
CVE-2025-11235 affects Progress MOVEit Transfer versions prior to 2023.1.3, 2023.0.8, 2022.1.11, and 2022.0.10.
What type of vulnerability is CVE-2025-11235?
CVE-2025-11235 is an unverified password change vulnerability that could allow unauthorized access.
Is there a workaround for CVE-2025-11235 until I can patch?
Currently, there are no documented workarounds for CVE-2025-11235, making timely updates essential.