UpHeron
All vulnerabilities

Servers and applications

CVE-2020-28647

In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).

Severity
Medium 5.4
Published
17 Nov 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2020.1
Sources
NVD

Affected software

SoftwareAffected versions
MOVEit TransferServers and applications · cpe:a:progress:moveit_transfer
  • Every version before 2020.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-28647
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-28647