Critical severity · published Jul 5, 2023
CVE-2023-36934
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection…
9.1
CVSS
95.2%
EPSS
No
On KEV
Description
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)95.2% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
MOVEit Transfer · Progress
before 12.1.11; 13.0.0 before 13.0.9; 13.1.0 before 13.1.7; 14.0.0 before 14.0.7; 14.1.0 before 14.1.8; 15.0.0 before 15.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-36934
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-36934
Patch
https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
Product
https://www.progress.com/moveit
More from MOVEit Transfer
9.8
CVE-2023-34362
Progress MOVEit Transfer SQL Injection Vulnerability
9.8
CVE-2026-89073
MOVEit Transfer Access restriction bypass in OAuth authentication
9.8
CVE-2026-89068
MOVEit Transfer Authentication bypass in LDAP sign-on
9.8
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce updated account restrictions
9.8
CVE-2026-15966
Improper CORS handling in MOVEit Transfer