CVE-2023-36933: In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a…

High severity · published Jul 5, 2023

CVE-2023-36933

In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a…

7.5

CVSS

72.2%

EPSS

On KEV

Description

In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)72.2% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MOVEit Transfer · Progress

before 2020.1.11; 2021.0 before 2021.0.9; 2021.1.0 before 2021.1.7; 2022.0.0 before 2022.0.7; 2022.1.0 before 2022.1.8; 2023.0.0 before 2023.0.4 · source: NVD

Affected product

MOVEit Transfer

Progress

All MOVEit Transfer CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-36933

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-36933

Release Notes

https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023

Product

https://www.progress.com/moveit