# CVE-2025-13147: Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.

Source: https://junglewise.ai/threats/cve-2025-13147-server-side-request-forgery-ssrf-vulnerability-in-progress-moveit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-19  
License: CC BY 4.0 with a link back

CVE-2025-13147 · Severity: medium · CVSS 5.3 · Published 2025-11-19

Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.

Technologies: [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2025-13147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13147 being exploited in the wild.

**How severe is CVE-2025-13147?** Medium severity, with a CVSS score of 5.3, published 19 November 2025.

**Which products and versions are affected?** Progress MOVEit Transfer. The advisory does not name versions.

**Is there a fix for CVE-2025-13147?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-13147?** Check whether you run Progress MOVEit Transfer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Progress MOVEit Transfer

## Related threats

- [Progress MOVEit Transfer SFTP authentication algorithm incorrect implementation](https://junglewise.ai/threats/cve-2026-89077-incorrect-implementation-of-authentication-algorithm)
- [Progress MOVEit Transfer SQL injection in Custom Reports](https://junglewise.ai/threats/cve-2026-89076-improper-neutralization-of-special-elements-used-in-an-sql)
- [Progress MOVEit Transfer insecure storage of sensitive information](https://junglewise.ai/threats/cve-2026-89075-insecure-storage-of-sensitive-information-vulnerability-in)
- [Progress MOVEit Transfer unicode encoding handling vulnerability](https://junglewise.ai/threats/cve-2026-89074-improper-handling-of-unicode-encoding-vulnerability-in-progress)
- [Progress MOVEit Transfer insufficient session expiration](https://junglewise.ai/threats/cve-2026-89073-insufficient-session-expiration-vulnerability-in-progress-moveit)