CVE-2025-11235

Published: Jan 7, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

Affected (4)

Products: Progress: Moveit Transfer

Progress

1 product

Moveit Transfer

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Progress Moveit Transfer	From 2022.0.0 to 2022.0.10
Progress Moveit Transfer	From 2022.1.0 to 2022.1.11
Progress Moveit Transfer	From 2023.0.0 to 2023.0.8
Progress Moveit Transfer	From 2023.1.0 to 2023.1.3

Related CWEs

CWE-620

Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

References (1)

https://docs.progress.com/bundle/moveit-transfer-release-notes-2023_1/page/Fixed-Issues-in-2023.1.3.html

Source: security@progress.com

Release Notes

Timeline

No history available yet.