Community Corner — Nichol Goldstein (Progress) asked a question.

Edited June 9, 2023 at 7:29 PM
MOVEit Transfer Critical Vulnerability (May 2023)

**UPDATE** 6/9/2023

 

PRODUCT ADVISORY: MOVEit Transfer and MOVEit Cloud Vulnerability, click for mitigation measures and patch information.

 

~~~~~~~~~~~~

Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment.

 

If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted in this knowledge base article in order to help protect your MOVEit Transfer environment, while our team produces a patch.

  • 31 answers
  • 2.75K views
Jeff Yaw, Paul DeSantis, and Jason Williams like this.

    • Jason Riker (Methodist Hospital of Southern California)

      I have this same question.

       

      Thank you -- Jason

  • SP Administrator (Customer)

    We're assuming/hoping that it's NOT impacted, but a confirmation from the vendor would be great. Calling them is no use at the moment, that's for sure.

     

    Cheers

  • Anoop Mohan (Customer)

    This is my assumption on this. Keeping my fingers crossed though. It is only applicable to services visible or exposed to internet through a public IP. As long as your MoveIT Automation Server is within your DMZ and not having a public IP it is not prone to the attack even though the application admin web site may have the same vulnerability. So unless you are facing a targeted attack, it is not critical at this point. But a patch may be due neverthless.

    • Brian Taylor (Customer)

      This has been my position as well, exposure would come from external internet attacks. DMZ protected here as well. Automation continues to use PORT443 internally.

    • Jeff Kohut (Customer)

      Nichol, Thank you for escalating this as it always helps corporate security to have a clear statement about related products. Could you also please have them differentiate on IF the MOVEit Automation Web Interface is/is not installed?

      I have not installed the Web Interface for MOVEit Automation in the past because of web engine (Apache Tomcat ?) cannot be updated independent of MOVEit Automation application updates and as a result is move likely to have security related issues such as this.

      Thanks,

      Jeff

      • Aparna Singireddy (Progress Software)

        Hi Jeff,

         

        None of the components in Automation are impacted.

        Web admin is also not impacted.

         

        Regards

        Aparna

      • Nichol Goldstein (Progress)

        Hi @Jeff Kohut (Customer)​ 

        I'm always here for you to help get you what you need.

        One of our moderators mentions in the thread that MOVEit Automation is not impacted. Do you need a deeper drill down? As your question is very specific and I'm not a technical person, I just wanted to ensure you are all set.

10 of 31