ZDI-CAN-21496: ZDI-23-897: Progress Software MOVEit Transfer UserProcessPassChangeRequest SQL Injection Remote Code Execution Vulnerability
Published Jul 5, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software MOVEit Transfer. Authentication is not required to exploit this vulnerability.
Affected Software
1 affected component
Progress Software MOVEit Transfer
Event History
Jul 5, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-21496?
ZDI-CAN-21496 is considered critical due to its ability to allow remote code execution without authentication.
2
How do I fix ZDI-CAN-21496?
To address ZDI-CAN-21496, apply the latest security patches provided by Progress Software for MOVEit Transfer.
3
Who is affected by ZDI-CAN-21496?
All installations of Progress Software MOVEit Transfer are potentially vulnerable to ZDI-CAN-21496.
4
Does ZDI-CAN-21496 require authentication to exploit?
No, ZDI-CAN-21496 can be exploited without requiring authentication.
5
What type of attacks does ZDI-CAN-21496 facilitate?
ZDI-CAN-21496 allows remote attackers to execute arbitrary code on the affected system.