CVE-2025-11235— MOVEit Transfer REST API does not require current password in order to initiate the password change process
Quick assessment
Affected
Progress MOVEit Transfer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Progress MOVEit Transfer是Progress公司的一款安全的托管文件传输应用程序。 Progress MOVEit Transfer存在安全漏洞，该漏洞源于密码更改未经验证。以下版本受到影响：2023.1.0版本至2023.1.3之前版本、2023.0.0版本至2023.0.8之前版本、2022.1.0版本至2022.1.11之前版本和2022.0.0版本至2022.0.10之前版本。
Possible ATT&CK Techniques 3 AI
T1136 · Create Account T1110.004 · Credential Stuffing T1136.003 · Cloud Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-11235
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MOVEit Transfer REST API does not require current password in order to initiate the password change process
Source: CVE Program / CVE List V5
Vulnerability Description
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未经验证的口令修改
Source: CVE Program / CVE List V5
Vulnerability Title
Progress MOVEit Transfer 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress MOVEit Transfer是Progress公司的一款安全的托管文件传输应用程序。 Progress MOVEit Transfer存在安全漏洞，该漏洞源于密码更改未经验证。以下版本受到影响：2023.1.0版本至2023.1.3之前版本、2023.0.0版本至2023.0.8之前版本、2022.1.0版本至2022.1.11之前版本和2022.0.0版本至2022.0.10之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress | MOVEit Transfer | 2023.1.0 ~ 2023.1.3 | - |
|
II. Public POCs for CVE-2025-11235
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-11235
请登录查看更多情报信息。
Other References for CVE-2025-11235 (1)
IV. Related Vulnerabilities
Same product: MOVEit Transfer
-
CVE-2026-15968
Stored XSS vulnerability in MOVEit Transfer -
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce up -
CVE-2026-15966
Improper CORS handling in MOVEit Transfer -
CVE-2026-10697
MFA Bypass in MOVEit Transfer -
CVE-2026-8801
File Extension Restriction Bypass in MOVEit Transfer
Same vendor: Progress
-
CVE-2026-16137
Path traversal via unsanitized upload filename leads to arbi -
CVE-2026-16138
Remote code execution via unsafe deserialization in Progress -
CVE-2026-16139
Arbitrary file write via path traversal in Progress ShareFil -
CVE-2026-15968
Stored XSS vulnerability in MOVEit Transfer -
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce up
Same weakness: CWE-620
-
CVE-2026-92467
microservices-platform through 6.0.0 Unverified Password Cha -
CVE-2026-91995
pig before 4.1.0 Unverified Password Change via /register/pa -
CVE-2026-46623
OpenAM Account Takeover via Unverified Password Change in OA -
CVE-2026-54175
backpack/crud: Unverified password change in MyAccountContro -
CVE-2026-86260
sfturing hosp_order Password Recovery CommonUserController.j
V. Comments for CVE-2025-11235
No comments yet