CVE-2020-28647: progress moveit_transfer Cross-site Scripting
Vulnerability summary
CVE-2020-28647 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in progress moveit_transfer. EPSS estimates a 1.47% chance of exploitation in the next 30 days, higher than 73.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 17-11-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.47%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.47% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (labs.secforce.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Progress1 product
- moveit_transfer< 2020.1
1 vendor · 1 product
References
3 links- community.progress.com/s/article/MOVEit-Transfer-Vulnerability-Nov-2020X Refsource CONFIRMVendor Advisory
- labs.secforce.com/posts/progress-moveit-transfer-2020.1-stored-xss-cve-2020-28647/X Refsource MISCExploitThird Party Advisory