Critical severity · published Jun 16, 2023
CVE-2023-35708
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been…
9.8
CVSS
96.7%
EPSS
No
On KEV
Description
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)96.7% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
MOVEit Transfer · Progress
before 2020.1.10; 2021.0.6 before 2021.0.8; 2021.1.4 before 2021.1.6; 2022.0.4 before 2022.0.6; 2022.1.5 before 2022.1.7; 2023.0.1 before 2023.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-35708
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-35708
Mitigation
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023
Third Party Advisory
https://www.cisa.gov/news-events/alerts/2023/06/15/progress-software-releases-security-advisory-moveit-transfer-vulnerability
Vendor Advisory
https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability
More from MOVEit Transfer
9.8
CVE-2023-34362
Progress MOVEit Transfer SQL Injection Vulnerability
9.8
CVE-2026-89073
MOVEit Transfer Access restriction bypass in OAuth authentication
9.8
CVE-2026-89068
MOVEit Transfer Authentication bypass in LDAP sign-on
9.8
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce updated account restrictions
9.8
CVE-2026-15966
Improper CORS handling in MOVEit Transfer