CVE-2023-35036
CriticalCVSS 9.1Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
SQL injection vulnerabilities have been found in the MOVEit Transfer web application before versions 2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6, and 2023.0.2. An unauthenticated attacker could gain unauthorized access to MOVEit Transfer's database.
Risk Assessment
This vulnerability could lead to unauthorized modification and disclosure of database content, posing a serious threat to the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to update MOVEit Transfer to the latest version to mitigate these vulnerabilities and conduct a security audit of the application.
Original NVD description (English source)
In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.