CVE-2024-5805CWE-287

MOVEit Gateway Authentication Bypass Vulnerability

Critical · published June 25, 2024

CVSS v3.1
9.1
EPSS
7%
Percentile
94.0
In the wild
Unconfirmed
What it is

🚨 Just one misconfigured setting could let anyone bypass authentication in MOVEit Gateway! 🔥 It's like leaving your front door unlocked because you thought the lock was strong enough—it invites unwanted guests right in! 🏡 An attacker could stroll right past your defenses, gaining full access to sensitive files and data, potentially leading to devastating breaches or data leaks. The stakes are extraordinarily high with this vulnerability—this is not just a simple oversight, but a wide-open door to your digital assets.

Put simply

It's like leaving your front door unlocked because you thought the lock was strong enough—it invites unwanted guests right in! 🏡 This improper authentication vulnerability in Progress MOVEit Gateway allows attackers to bypass authentication checks completely, impacting version 2024.0.0. Essentially, it creates a loophole that can be exploited without needing legitimate access.

What to do

An attacker could stroll right past your defenses, gaining full access to sensitive files and data, potentially leading to devastating breaches or data leaks. The stakes are extraordinarily high with this vulnerability—this is not just a simple oversight, but a wide-open door to your digital assets. Patch immediately to the latest version that addresses this vulnerability, and double-check your authentication configurations to ensure they are set up correctly. Regular audits of your security settings can help prevent future issues. You've got this! With vigilance and a few quick updates, you'll have a fortress in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.06762 · 94.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-06-25T15:03Z
EPSS history
Timeline
  • 25 JUN 15:03Z
    MOVEit Gateway Authentication Bypass Vulnerability
    cvelistv5