The vulnerability of the software for processing and transmitting confidential data in Progress MOVEit Transfer arises from the lack of measures taken to protect the SQL query structure. This allows attackers to enhance their privileges.

🗓️ 16 Jun 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

MOVEit Transfer vulnerability allows remote privilege escalation due to unprotected SQL query structure in data processing.

Reporter	Title	Published	Views	Family All 83
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	9 Jul 202318:44	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	9 Jun 202319:07	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	6 Jun 202618:25	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	28 Jun 202417:13	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	31 Aug 202313:25	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	6 May 202600:17	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Lexmark Cxtpc_Firmware	7 Aug 202320:55	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	28 Jul 202505:55	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	21 Jan 202605:03	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	16 Jun 202300:39	–	githubexploit

Vulners

Node

progress_software moveit_transferRange2023.0.0–2023.0.2

OR

progress_software moveit_transferRange2022.1.0–2022.1.6

OR

progress_software moveit_transferRange2022.0.0–2022.0.5

OR

progress_software moveit_transferRange2021.1.0–2021.1.5

OR

progress_software moveit_transferRange2021.0.0–2021.0.7

OR

progress_software moveit_transferRange≤2020.1.6

OR

progress_software moveit_cloudRange14.1.0.0–14.1.6.97

OR

progress_software moveit_cloudMatch15.0.2.39

OR

progress_software moveit_cloudRange14.0.0.0–14.0.5.45

Source	Link
community	www.community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
github	www.github.com/horizon3ai/CVE-2023-34362
rapid7	www.rapid7.com/db/vulnerabilities/progress-moveit-transfer-critical-may-2023/
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 39.8

CVSS 210

EPSS0.99934

MOVEit Transfer unprotected SQL query remote privilege escalation data processing transmission