CRITICAL🇵🇱 Wersja polska

CVE-2023-35036

CVSS 9.1v3.1pub. 2023-06-12upd. 2025-01-03

In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Progress Moveit Transfer

    APP
    Progress
    < 2021.0.72021.1.0 – 2021.1.5 (bez)2022.0.0 – 2022.0.5 (bez)2022.1.0 – 2022.1.6 (bez)2023.0.0 – 2023.0.2 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLiAuth Bypass
CWE
References

Related vulnerabilities

CVE-2023-34362CRITICAL9.8⚠ KEVten sam produkt

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5),...

CVE-2024-5806CRITICAL9.1PL ✓ten sam produkt

Authentication Bypass w module SFTP Progress MOVEit Transfer

CVE-2023-36934CRITICAL9.1ten sam produkt

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7...

CVE-2023-35708CRITICAL9.8ten sam produkt

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7),...

CVE-2021-38159CRITICAL9.8ten sam produkt

In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfe...