CVE-2023-36934

· CRITICALModified

← All CVEs

CVSS v3.1

9.1

EPSS

95.18%

Published

Jul 5, 2023

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-89

Affected Products (6)

progress · moveit_transfer (up to 12.1.11)vulnerable

progress · moveit_transfer (up to 13.0.9)vulnerable

progress · moveit_transfer (up to 13.1.7)vulnerable

progress · moveit_transfer (up to 14.0.7)vulnerable

progress · moveit_transfer (up to 14.1.8)vulnerable

progress · moveit_transfer (up to 15.0.4)vulnerable

References (4)