In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.
References
| Link | Resource |
|---|---|
| https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 | Vendor Advisory |
| https://www.progress.com/moveit | Product |
| https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 | Vendor Advisory |
| https://www.progress.com/moveit | Product |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 - Vendor Advisory | |
| References | () https://www.progress.com/moveit - Product |
22 Sep 2023, 18:31
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | (MISC) https://www.progress.com/moveit - Product | |
| References | (MISC) https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023 - Vendor Advisory | |
| First Time |
Progress
Progress moveit Transfer |
|
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:* |
20 Sep 2023, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-20 17:15
Updated : 2024-11-21 08:22
NVD link : CVE-2023-42660
Mitre link : CVE-2023-42660
CVE.ORG link : CVE-2023-42660
JSON object : View
Products Affected
progress
- moveit_transfer
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')