CVE-2020-12677

Published: May 14, 2020Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. This affects 2018 - 2018.0 prior to 2018.0.3, 2018 SP1 - 2018.2 prior to 2018.2.3, 2018 SP2 - 2018.3 prior to 2018.3.7, 2019 - 2019.0 prior to 2019.0.3, 2019.1 - 2019.1 prior to 2019.1.2, and 2019.2 - 2019.2 prior to 2019.2.2.

Affected (6)

Products: Progress: Moveit Automation

1 product

Moveit Automation

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Progress Moveit Automation	From 2018.0 to 2018.0.3
Progress Moveit Automation	From 2018.2 to 2018.2.3
Progress Moveit Automation	From 2018.3 to 2018.3.7
Progress Moveit Automation	From 2019.0 to 2019.0.3
Progress Moveit Automation	From 2019.1 to 2019.1.2
Progress Moveit Automation	From 2019.2 to 2019.2.2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (14)

https://community.progress.com/s/article/MOVEit-Automation-Cross-Site-Scripting-Vulnerability-XSS-May-2020

Source: cve@mitre.org

PatchVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2018/ReleaseNotes/en/index.htm#33958.htm

Source: cve@mitre.org

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2018SP1/ReleaseNotes/en/index.htm#33958.htm

Source: cve@mitre.org

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2018SP2/ReleaseNotes/en/index.htm#33958.htm

Source: cve@mitre.org

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2019/ReleaseNotes/en/index.htm#33958.htm

Source: cve@mitre.org

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2019_1/ReleaseNotes/en/index.htm#33958.htm

Source: cve@mitre.org

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2019_2/ReleaseNotes/en/index.htm#33958.htm

Source: cve@mitre.org

Release NotesVendor Advisory

https://community.progress.com/s/article/MOVEit-Automation-Cross-Site-Scripting-Vulnerability-XSS-May-2020

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2018/ReleaseNotes/en/index.htm#33958.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2018SP1/ReleaseNotes/en/index.htm#33958.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2018SP2/ReleaseNotes/en/index.htm#33958.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2019/ReleaseNotes/en/index.htm#33958.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2019_1/ReleaseNotes/en/index.htm#33958.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://docs.ipswitch.com/MOVEit/Automation2019_2/ReleaseNotes/en/index.htm#33958.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.