CVE-2023-36934: SQL Injection
First published: Wed Jul 05 2023(Updated: )
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Progress MOVEit Transfer | <12.1.11 | |
| Progress MOVEit Transfer | >=13.0.0<13.0.9 | |
| Progress MOVEit Transfer | >=13.1.0<13.1.7 | |
| Progress MOVEit Transfer | >=14.0.0<14.0.7 | |
| Progress MOVEit Transfer | >=14.1.0<14.1.8 | |
| Progress MOVEit Transfer | >=15.0.0<15.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-36934?
CVE-2023-36934 is a SQL injection vulnerability identified in the MOVEit Transfer web application.
What is the severity of CVE-2023-36934?
CVE-2023-36934 has a severity rating of 9.1 out of 10, which is considered critical.
How does CVE-2023-36934 affect Progress MOVEit Transfer?
CVE-2023-36934 affects Progress MOVEit Transfer versions before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4).
How can an attacker exploit CVE-2023-36934?
An unauthenticated attacker can exploit CVE-2023-36934 by utilizing SQL injection techniques to gain unauthorized access to the MOVEit Transfer web application.
Are there any patches or updates available for CVE-2023-36934?
Yes, patches are available for CVE-2023-36934. It is recommended to update Progress MOVEit Transfer to versions 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), or 2023.0.4 (15.0.4) to mitigate the vulnerability.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/event
- vendor/progress
- canonical/progress moveit transfer
- version/progress moveit transfer/13.0.0
- version/progress moveit transfer/13.1.0
- version/progress moveit transfer/14.0.0
- version/progress moveit transfer/14.1.0
- version/progress moveit transfer/15.0.0