CVE-2024-2291
Progress Moveit Transfer ≤ 2022.0.11
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-2291 is a medium-severity Insufficient Logging (CWE-778) vulnerability in Progress Moveit Transfer. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AU-12 (Audit Record Generation) and AU-2 (Event Logging) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27246
Vulnerability Data
In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results…
more
in user activity not being logged properly.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 11 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
AU-12 requires the system to generate audit records for defined events, structurally eliminating the root condition of insufficient logging.
AU-2 requires identification and logging of security-relevant event types, directly stopping omission of critical events.
AU-3 mandates that audit records contain the specific details needed to understand what occurred, preventing incomplete event descriptions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Insufficient logging directly prevents generation of the incident data/metadata that RS.AN-07 requires, so the weakness starves collection/preservation completely in both directions.
Insufficient logging largely blinds event analysis by omitting the critical details needed to understand adverse activities.
Insufficient logging starves the multiple log sources and SIEM correlation that DE.AE-03 relies on, largely defeating its ability to operate while the logging gap removes most of the correlation outcome's value.
Insufficient logging starves impact/scope estimation of the event details required to produce accurate estimates, removing most of the outcome's value while leaving limited non-log avenues intact.
Insufficient logging starves DE.AE-06 of the event data that must be delivered to staff/tools, removing most of the outcome's value while the delivery mechanisms themselves remain intact.
Insufficient logging starves incident declaration of the event details needed to evaluate criteria, removing most of the outcome's efficacy in both directions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating comprehensive event logging with user IDs, timestamps, and access attempts directly eliminates the absence of audit trails that would otherwise allow undetected exploitation.
Mandating retention of monitoring records and real-time or periodic logging directly counters insufficient logging by ensuring security-relevant events are captured.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248726 The OL 8 System must take appropriate action when an audit processing failure occurs. blocks CWE-778
- V-248728 The OL 8 audit system must take appropriate action when the audit storage volume is full. blocks CWE-778
Oracle Linux 9 (1 rule)
- V-271579 OL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. blocks CWE-778
RHEL 8 (4 rules)
- V-230390 The RHEL 8 System must take appropriate action when an audit processing failure occurs. blocks CWE-778
- V-230439 Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in RHEL 8 must generate an audit record. blocks CWE-778
- V-230455 Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in RHEL 8 must generate an audit record. blocks CWE-778
RHEL 9 (1 rule)
- V-258153 RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. blocks CWE-778