CVE-2024-2291CWE-778

MOVEit Transfer Logging Bypass Vulnerability

Medium · published March 20, 2024

CVSS v3.1

4.3

EPSS

Percentile

31.4

In the wild

Unconfirmed

What it is

In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00385 · 31.4th percentile
Weakness: CWE-778 · Insufficient Logging
Published: 2024-03-20T14:46Z

EPSS history

Timeline

20 MAR 14:46Z
MOVEit Transfer Logging Bypass Vulnerability
cvelistv5