Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
MOVEit Transfer Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2023-6217 - Vulnerability Database
MOVEit Transfer

MOVEit Transfer Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2023-6217

Medium
Reference: CVE-2023-6217
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2023-6217
Title: MOVEit Transfer Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9) 2022.1.10 (14.1.10) 2023.0.7 (15.0.7)a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload the attacker would be able to execute malicious JavaScript within the context of the victims browser.