CVE-2025-11235 — MOVEit Transfer REST API does not require current password in order to initiate the password change process

CVE-2025-11235

MOVEit Transfer REST API does not require current password in order to initiate the password change process PUBLISHED

Description (CNA)

Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

Affected (CNA)

Vendor / product	Versions
Progress / MOVEit Transfer	affected 2023.1.0 before 2023.1.3; affected 2023.0.0 before 2023.0.8; affected 2022.1.0 before 2022.1.11; affected 2022.0.0 before 2022.0.10

CWE

CWE-620

References

https://docs.progress.com/bundle/moveit-transfer-release-notes-2023_1/page/Fixed-Issues-in-2023.1.3.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.