CVE-2020-12677

MEDIUM

6.1

CVSS Score

Published: May 14, 2020 at 05:34 PM UTC

Updated: June 17, 2026 at 02:52 AM UTC

1 product affected across 1 vendorMOVEit Automation

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploit prediction

EPSS 2%

Description

An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. This affects 2018 - 2018.0 prior to 2018.0.3, 2018 SP1 - 2018.2 prior to 2018.2.3, 2018 SP2 - 2018.3 prior to 2018.3.7, 2019 - 2019.0 prior to 2019.0.3, 2019.1 - 2019.1 prior to 2019.1.2, and 2019.2 - 2019.2 prior to 2019.2.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

MOVEit Automation · Progress

95%

2018.0 ≤ v < 2018.0.32018.2 ≤ v < 2018.2.32018.3 ≤ v < 2018.3.72019.0 ≤ v < 2019.0.32019.1 ≤ v < 2019.1.22019.2 ≤ v < 2019.2.2

Affected range stops below 2018.0.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 2018.2.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 2018.3.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 2019.0.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 2019.1.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2019.2.2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references