MOVEit Transfer fixes three new vulnerabilities

🗓️ 10 Jul 2023 04:00:00Reported by Malwarebytes blogType

malwarebytes🔗 www.malwarebytes.com👁 37 Views

MOVEit Transfer vulnerabilities must be fixed by updating to the latest version 2020.1.6 or later. The software had SQL injection vulnerabilities and possible unhandled exceptions that could allow unauthorized access to the database, leading to disclosure of sensitive information. Users are advised to review the official Progress article for updating and apply the necessary patches to avoid potential exploits by cybercriminals.

Reporter	Title	Published	Views	Family All 44
ATTACKERKB	CVE-2023-36933	5 Jul 202316:15	–	attackerkb
ATTACKERKB	CVE-2023-36932	5 Jul 202316:15	–	attackerkb
ATTACKERKB	CVE-2023-36934	5 Jul 202316:15	–	attackerkb
BDU FSTEC	The vulnerability of the software for processing and transmitting confidential data in Progress MOVEit Transfer arises from the lack of measures taken to protect the SQL query structure. This allows attackers to circumvent security restrictions, execute arbitrary SQL code, and gain unauthorized access to read, modify, or delete data.	11 Jul 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the software for processing and transmitting confidential data in Progress MOVEit Transfer arises from the lack of measures taken to protect the SQL query structure. This allows attackers to circumvent security restrictions, execute arbitrary SQL code, and gain unauthorized access to read, modify, or delete data.	11 Jul 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the software for processing and transmitting confidential data in Progress MOVEit Transfer arises from the improper implementation of the sequence of actions to be performed. This allows a perpetrator to trigger a service failure.	13 Jul 202300:00	–	bdu_fstec
Circl	CVE-2023-36932	5 Jul 202320:22	–	circl
Circl	CVE-2023-36933	5 Jul 202320:21	–	circl
Circl	CVE-2023-36934	5 Jul 202320:22	–	circl
CISA	Progress Software Releases Service Pack for MOVEit Transfer Vulnerabilities	7 Jul 202312:00	–	cisa