CVE-2025-11235 - Vulnerability Details - OpenCVE

Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Microsoft	Windows
Progress	Moveit Transfer

No data.

No data.

References

Link	Providers
https://docs.progress.com/bundle/moveit-transfer-release-notes-2023_1/page/Fixed-Issues-in-2023.1.3.html

History

Wed, 07 Jan 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 07 Jan 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft Microsoft windows Progress Progress moveit Transfer
Vendors & Products		Microsoft Microsoft windows Progress Progress moveit Transfer

Tue, 06 Jan 2026 22:30:00 +0000

Type	Values Removed	Values Added
Description		Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
Title		MOVEit Transfer REST API does not require current password in order to initiate the password change process
Weaknesses		CWE-620
References		https://docs.progress.com/bundle/moveit-transfer-release-notes-2023_1/page/Fixed-Issues-in-2023.1.3.html
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published: 2026-01-06T22:16:48.036Z

Updated: 2026-01-07T16:25:41.732Z

Reserved: 2025-10-01T19:09:58.385Z

Link: CVE-2025-11235

Vulnrichment

Updated: 2026-01-07T16:25:19.911Z

NVD

Status : Received

Published: 2026-01-07T12:16:46.237

Modified: 2026-01-07T12:16:46.237

Link: CVE-2025-11235

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11235", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2025-10-01T19:09:58.385Z", "datePublished": "2026-01-06T22:16:48.036Z", "dateUpdated": "2026-01-07T16:25:41.732Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["REST API"], "platforms": ["Windows"], "product": "MOVEit Transfer", "vendor": "Progress", "versions": [{"lessThan": "2023.1.3", "status": "affected", "version": "2023.1.0", "versionType": "semver"}, {"lessThan": "2023.0.8", "status": "affected", "version": "2023.0.0", "versionType": "semver"}, {"lessThan": "2022.1.11", "status": "affected", "version": "2022.1.0", "versionType": "semver"}, {"lessThan": "2022.0.10", "status": "affected", "version": "2022.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Aden Yap Chuen Zhen, BAE SYSTEM Digital Intelligence"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).<p>This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.</p>"}], "value": "Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-620", "description": "CWE-620 Unverified Password Change", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-01-06T22:16:48.036Z"}, "references": [{"url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2023_1/page/Fixed-Issues-in-2023.1.3.html"}], "source": {"discovery": "UNKNOWN"}, "title": "MOVEit Transfer REST API does not require current password in order to initiate the password change process", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T16:24:49.767769Z", "id": "CVE-2025-11235", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:25:41.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11235", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T16:24:49.767769Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:25:19.911Z"}}], "cna": {"title": "MOVEit Transfer REST API does not require current password in order to initiate the password change process", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Aden Yap Chuen Zhen, BAE SYSTEM Digital Intelligence"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress", "modules": ["REST API"], "product": "MOVEit Transfer", "versions": [{"status": "affected", "version": "2023.1.0", "lessThan": "2023.1.3", "versionType": "semver"}, {"status": "affected", "version": "2023.0.0", "lessThan": "2023.0.8", "versionType": "semver"}, {"status": "affected", "version": "2022.1.0", "lessThan": "2022.1.11", "versionType": "semver"}, {"status": "affected", "version": "2022.0.0", "lessThan": "2022.0.10", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2023_1/page/Fixed-Issues-in-2023.1.3.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.", "supportingMedia": [{"type": "text/html", "value": "Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).<p>This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-620", "description": "CWE-620 Unverified Password Change"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-01-06T22:16:48.036Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11235", "state": "PUBLISHED", "dateUpdated": "2026-01-07T16:25:41.732Z", "dateReserved": "2025-10-01T19:09:58.385Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-01-06T22:16:48.036Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}