CVE-2023-42660

MOVEit Transfer Machine Interface SQL Injection

Published Sep 20, 2023 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Progress Software Corporation

MOVEit Transfer

affected

Version	Status	Constraints
`2023.0.0 (15.0.0)`	affected	< 2023.0.6 (15.0.6)
`2022.1.0 (14.1.0)`	affected	< 2022.1.9 (14.1.9)
`2022.0.0 (14.0.0)`	affected	< 2022.0.8 (14.0.8)
`2021.1.0 (13.1.0)`	affected	< 2021.1.8 (13.1.8)

Configuration 1 [-]

OR	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-47093	In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.