Progress MOVEit Transfer Improper Privilege Management Vulnerability Allowing Privilege Escalation

A vulnerability in Progress MOVEit Transfer's SFTP module allows users with Shared Accounts to improperly escalate privileges. This issue grants unintended List permissions on folders, affecting versions 2023.1.0 prior to 2023.1.12, 2024.0.0 prior to 2024.0.8, and 2024.1.0 prior to 2024.1.2.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing users to gain additional permissions they should not have.

Remediation

Users can upgrade to MOVEit Transfer 2024.1.2, 2024.0.8, or 2023.1.12. Instructions for downloading the update are available on the Progress Community Download Center.