Description
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Progress | MOVEit Transfer | 2023.0.0 – < 2023.0.11, 2023.1.0 – < 2023.1.6, 2024.0.0 – < 2024.0.2 | 2023.0.11 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Progress MOVEit SFTP Authentication Bypass for Arbitrary File Read
auxiliary/gather/progress_moveit_sftp_fileread_cve_2024_5806
GitHub 2 repositories
-
watchtowrlabs/watchTowr-vs-progress-moveit_CVE-2024-5806 ★ 44 · Jun 24, 2024
Exploit for the CVE-2024-5806
-
sec13b/CVE-2024-5806 ★ 0 · Mar 8, 2025
progress moveit cve-2024-5806
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- NCSC-2024-0267 Kwetsbaarheden verholpen in Progress MOVEit NCSC-NL (Netherlands) · Jun 26, 2024
- WID-SEC-2024-1457 Progress Software MOVEit: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jun 25, 2024