Critical severity9.1NVD Advisory· Published Jun 12, 2023· Updated Jun 17, 2026
CVE-2023-35036
CVE-2023-35036
Description
In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
Affected products
3cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*range: <2021.0.7
- (no CPE)range: <2021.0.7, <2021.1.5, <2022.0.5, <2022.1.6, <2023.0.2
- Progress/MOVEit Transferdescription
Patches
Vulnerability mechanics
References
2- archive.is/58ty7nvdThird Party Advisory
- community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-CVE-2023-35036-June-9-2023nvdVendor Advisory
News mentions
0No linked articles in our index yet.