CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6217 – MOVEit Transfer XSS via MOVEit Gateway
https://notcve.org/view.php?id=CVE-2023-6217
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser. En las versiones de Progress MOVEit Transfer lanzadas antes de 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), se identificó una vulnerabilidad de cross-site scripting (XSS) reflejada cuando MOVEit Gateway se utiliza junto con MOVEit Transfer. Un atacante podría crear un payload malicioso dirigida al sistema que comprende una implementación de MOVEit Gateway y MOVEit Transfer. • https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023 https://www.progress.com/moveit • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2023-42656 – MOVEit Transfer Reflected XSS
https://notcve.org/view.php?id=CVE-2023-42656
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. Versiones de MOVEit Transfer en progreso lanzadas antes de 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), cross-site scripting reflejado ( XSS) se ha identificado una vulnerabilidad en la interfaz web de MOVEit Transfer. Un atacante podría crear un payload malicioso dirigido a los usuarios de MOVEit Transfer durante el procedimiento de composición del paquete. • https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 https://www.progress.com/moveit • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2023-40043 – MOVEit Transfer System Administrator SQL Injection
https://notcve.org/view.php?id=CVE-2023-40043
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content. En las versiones de MOVEit Transfer lanzadas antes de 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), se ha identificado una vulnerabilidad de inyección SQL en la interfaz web de MOVEit Transfer que podría permitir que una cuenta de administrador del sistema MOVEit obtenga acceso no autorizado a la base de datos de MOVEit Transfer. Un administrador del sistema MOVEit podría enviar un payload manipulado a la interfaz web de MOVEit Transfer, lo que podría dar como resultado la modificación y divulgación del contenido de la base de datos de MOVEit. • https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-42660 – MOVEit Transfer Machine Interface SQL Injection
https://notcve.org/view.php?id=CVE-2023-42660
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content. En las versiones de MOVEit Transfer lanzadas antes de 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), se ha identificado una vulnerabilidad de inyección SQL en la interfaz de la máquina MOVEit Transfer que podría permitir que un atacante autenticado obtenga acceso no autorizado a la base de datos de MOVEit Transfer. Un atacante podría enviar un payload manipulado a la interfaz de la máquina MOVEit Transfer, lo que podría provocar la modificación y divulgación del contenido de la base de datos de MOVEit. • https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 10%CPEs: 6EXPL: 0CVE-2023-36934 – Progress Software MOVEit Transfer UserProcessPassChangeRequest SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-36934
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software MOVEit Transfer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the human.aspx endpoint. A crafted request can trigger execution of SQL queries composed from a user-supplied string. • https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •