How severe is CVE-2024-2291?

CVE-2024-2291 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2024-2291 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-2291?

CVE-2024-2291 affects Progress Moveit Transfer. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-2291?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-2291 have an EU (EUVD) identifier?

Yes. CVE-2024-2291 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-27246.

When was CVE-2024-2291 published?

CVE-2024-2291 was published on 2024-03-20 and last updated on 2026-06-17.

CVE-2024-2291

CVE-2024-2291 is a medium-severity vulnerability in Progress Moveit Transfer with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-778.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (31st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-27246
Weakness: CWE-778
Affected product: Progress Moveit Transfer
Published: 2024-03-20
Last modified: 2026-06-17

Description

In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.

Frequently asked questions

What is CVE-2024-2291?: In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.
How severe is CVE-2024-2291?: CVE-2024-2291 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2024-2291 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-2291?: CVE-2024-2291 affects Progress Moveit Transfer. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-2291?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-2291 have an EU (EUVD) identifier?: Yes. CVE-2024-2291 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-27246.
When was CVE-2024-2291 published?: CVE-2024-2291 was published on 2024-03-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*

More vulnerabilities in Progress Moveit Transfer

CVE-2023-35708 — Critical (CVSS 9.8): In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and…
CVE-2023-34362 — Critical (CVSS 9.8): In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and…
CVE-2021-38159 — Critical (CVSS 9.8): In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web…
CVE-2024-5806 — Critical (CVSS 9.1): Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This…
CVE-2023-36934 — Critical (CVSS 9.1): In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7),…
CVE-2023-35036 — Critical (CVSS 9.1): In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and…

All CVEs affecting Progress Moveit Transfer →

Other CWE-778 vulnerabilities

CVE-2024-48967 — Critical (CVSS 10.0): The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious…
CVE-2021-43419 — High (CVSS 7.5): An Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat…
CVE-2019-7613 — High (CVSS 7.5): Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain…
CVE-2019-19277 — Medium (CVSS 6.5): A vulnerability has been identified in SIPORT MP (All versions < 3.1.4). Vulnerable versions of the device allow the…
CVE-2025-52644 — Medium (CVSS 5.8): HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of…
CVE-2025-32967 — Medium (CVSS 5.4): OpenEMR is a free and open source electronic health records and medical practice management application. A logging…

Browse all CWE-778 vulnerabilities →