CVE-2023-36934: SQL Injection
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-36934?
CVE-2023-36934 is a SQL injection vulnerability identified in the MOVEit Transfer web application.
What is the severity of CVE-2023-36934?
CVE-2023-36934 has a severity rating of 9.1 out of 10, which is considered critical.
How does CVE-2023-36934 affect Progress MOVEit Transfer?
CVE-2023-36934 affects Progress MOVEit Transfer versions before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4).
How can an attacker exploit CVE-2023-36934?
An unauthenticated attacker can exploit CVE-2023-36934 by utilizing SQL injection techniques to gain unauthorized access to the MOVEit Transfer web application.
Are there any patches or updates available for CVE-2023-36934?
Yes, patches are available for CVE-2023-36934. It is recommended to update Progress MOVEit Transfer to versions 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), or 2023.0.4 (15.0.4) to mitigate the vulnerability.