← Vulnerability feed

Vulnerability record · CVE-2020-8612 · published 14 February 2020

CVE-2020-8612: Progess moveit transfer cross-site scripting vulnerability

Progess · Moveit Transfer

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS.

9.0 CVSS 3.1 Critical EPSS 1.7% · top 24.0% CWE-79 · Cross-site scripting
9.0CVSS 3.1 base score, v2 6.0
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020 PatchVendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm Release NotesVendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm Release NotesVendor Advisory
https://status.moveitcloud.com/ Product
https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020 PatchVendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm Release NotesVendor Advisory
https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm Release NotesVendor Advisory
https://status.moveitcloud.com/ Product

Track CVE-2020-8612 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-34362Progress MOVEit Transfer SQL injection allows unauthenticated database accessProgress MOVEit Transfer contains a SQL injection flaw in its web application that lets an unauthenticated attacker reach and manipulate the underlyi…KEVEPSS 100%analysed9.8CVE-2026-15966Progress moveit transfer vulnerabilityPermissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before …EPSS 0.37%9.8CVE-2026-15967Progress moveit transfer insufficient session expiration vulnerabilityInsufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before …EPSS 0.37%9.8CVE-2026-10697Progress moveit transfer improper authentication vulnerabilityImproper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.EPSS 0.60%9.8CVE-2026-8801Progress moveit transfer vulnerabilityPath equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0…EPSS 0.55%9.8CVE-2026-8649Progress moveit transfer vulnerabilityImproper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affect…EPSS 0.46%9.8CVE-2024-6576Progress moveit transfer improper authentication vulnerabilityImproper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: …EPSS 0.62%9.8CVE-2024-5806Progress MOVEit Transfer SFTP authentication bypassProgress MOVEit Transfer contains an improper authentication flaw in its SFTP module that allows authentication bypass. The affected versions are 202…EPSS 81%analysed

Source: NIST National Vulnerability Database (record CVE-2020-8612), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.