CRITICAL🇵🇱 Wersja polska

CVE-2023-36934

CVSS 9.1v3.1pub. 2023-07-05upd. 2024-11-21

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Progress Moveit Transfer

    APP
    Progress
    < 12.1.1113.0.0 – 13.0.9 (excl.)13.1.0 – 13.1.7 (excl.)14.0.0 – 14.0.7 (excl.)14.1.0 – 14.1.8 (excl.)15.0.0 – 15.0.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLiAuth Bypass
CWE
References

Related vulnerabilities

CVE-2023-34362CRITICAL9.8⚠ KEVPL ✓same product

SQL Injection w Progress MOVEit Transfer – nieautoryzowany dostęp do bazy danych

CVE-2024-5806CRITICAL9.1PL ✓same product

Authentication Bypass w module SFTP Progress MOVEit Transfer

CVE-2023-35708CRITICAL9.8PL ✓same product

SQL injection w Progress MOVEit Transfer — nieautoryzowany dostęp do bazy danych

CVE-2023-35036CRITICAL9.1PL ✓same product

SQL Injection w Progress MOVEit Transfer — nieautoryzowany dostęp do bazy danych

CVE-2021-38159CRITICAL9.8PL ✓same product

SQL Injection w Progress MOVEit Transfer — nieautoryzowany dostęp do bazy danych