CVE-2023-36934
CriticalCVSS 9.1Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A SQL injection vulnerability has been identified in the MOVEit Transfer web application before version 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4). An attacker could exploit this vulnerability to gain unauthorized access to the MOVEit Transfer database.
Risk Assessment
This vulnerability poses a serious risk to data security, allowing attackers to modify and disclose database content. This could lead to a loss of confidentiality and integrity of data within the organization.
Recommendation
It is recommended to update MOVEit Transfer to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify and remediate other potential vulnerabilities is advisable.
Original NVD description (English source)
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.