CVE-2023-6217 – MOVEit Transfer XSS via MOVEit Gateway

https://notcve.org/view.php?id=CVE-2023-6217

In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer.  An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser. En las versiones de Progress MOVEit Transfer lanzadas antes de 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), se identificó una vulnerabilidad de cross-site scripting (XSS) reflejada cuando MOVEit Gateway se utiliza junto con MOVEit Transfer. Un atacante podría crear un payload malicioso dirigida al sistema que comprende una implementación de MOVEit Gateway y MOVEit Transfer. • https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023 https://www.progress.com/moveit • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •