CRITICAL🇵🇱 Wersja polska

CVE-2023-36934

CVSS 9.1v3.1pub. 2023-07-05upd. 2024-11-21

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Progress Moveit Transfer

    APP
    Progress
    < 12.1.1113.0.0 – 13.0.9 (bez)13.1.0 – 13.1.7 (bez)14.0.0 – 14.0.7 (bez)14.1.0 – 14.1.8 (bez)15.0.0 – 15.0.4 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLiAuth Bypass
CWE
References

Related vulnerabilities

CVE-2023-34362CRITICAL9.8⚠ KEVten sam produkt

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5),...

CVE-2024-5806CRITICAL9.1PL ✓ten sam produkt

Authentication Bypass w module SFTP Progress MOVEit Transfer

CVE-2023-35708CRITICAL9.8ten sam produkt

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7),...

CVE-2023-35036CRITICAL9.1ten sam produkt

In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6),...

CVE-2021-38159CRITICAL9.8ten sam produkt

In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfe...