CVE-2023-35036: SQL Injection
First published: Mon Jun 12 2023(Updated: )
In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Progress MOVEit Transfer | <2021.0.7 | |
| Progress MOVEit Transfer | >=2021.1.0<2021.1.5 | |
| Progress MOVEit Transfer | >=2022.0.0<2022.0.5 | |
| Progress MOVEit Transfer | >=2022.1.0<2022.1.6 | |
| Progress MOVEit Transfer | >=2023.0.0<2023.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2023-35036?
CVE-2023-35036 is a SQL injection vulnerability found in the MOVEit Transfer web application.
How can an attacker exploit CVE-2023-35036?
An unauthenticated attacker can exploit CVE-2023-35036 to gain unauthorized access to MOVEit Transfer.
Which versions of MOVEit Transfer are affected by CVE-2023-35036?
MOVEit Transfer versions before 2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6, and 2023.0.2 are affected by CVE-2023-35036.
What is the severity of CVE-2023-35036?
CVE-2023-35036 has a severity rating of critical (9.1).
Where can I find more information about CVE-2023-35036?
More information about CVE-2023-35036 can be found in the following references: [Reference 1](https://archive.is/58ty7) and [Reference 2](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-CVE-2023-35036-June-9-2023).
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/zdnet-article
- source/ZDNet
- alias/CVE-2023-0669
- alias/CVE-2023-34362
- alias/CVE-2023-35036
- alias/CVE-2023-35708
- alias/CVE-2021-21974
- zeroday/true
- agent/news-ai
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/progress
- canonical/progress moveit transfer
- version/progress moveit transfer/2021.1.0
- version/progress moveit transfer/2022.0.0
- version/progress moveit transfer/2022.1.0
- version/progress moveit transfer/2023.0.0