CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2023-40043 – MOVEit Transfer System Administrator SQL Injection
https://notcve.org/view.php?id=CVE-2023-40043
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content. En las versiones de MOVEit Transfer lanzadas antes de 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), se ha identificado una vulnerabilidad de inyección SQL en la interfaz web de MOVEit Transfer que podría permitir que una cuenta de administrador del sistema MOVEit obtenga acceso no autorizado a la base de datos de MOVEit Transfer. Un administrador del sistema MOVEit podría enviar un payload manipulado a la interfaz web de MOVEit Transfer, lo que podría dar como resultado la modificación y divulgación del contenido de la base de datos de MOVEit. • https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-42660 – MOVEit Transfer Machine Interface SQL Injection
https://notcve.org/view.php?id=CVE-2023-42660
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content. En las versiones de MOVEit Transfer lanzadas antes de 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), se ha identificado una vulnerabilidad de inyección SQL en la interfaz de la máquina MOVEit Transfer que podría permitir que un atacante autenticado obtenga acceso no autorizado a la base de datos de MOVEit Transfer. Un atacante podría enviar un payload manipulado a la interfaz de la máquina MOVEit Transfer, lo que podría provocar la modificación y divulgación del contenido de la base de datos de MOVEit. • https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 10%CPEs: 6EXPL: 0CVE-2023-36934 – Progress Software MOVEit Transfer UserProcessPassChangeRequest SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-36934
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software MOVEit Transfer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the human.aspx endpoint. A crafted request can trigger execution of SQL queries composed from a user-supplied string. • https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 6EXPL: 0CVE-2023-36932
https://notcve.org/view.php?id=CVE-2023-36932
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. • https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-36933
https://notcve.org/view.php?id=CVE-2023-36933
In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly. • https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 https://www.progress.com/moveit • CWE-755: Improper Handling of Exceptional Conditions •