UpHeron
All vulnerabilities

Servers and applications

CVE-2023-35708

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer…

Severity
Critical 9.8
Published
16 Jun 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2020.1.10, 2021.0.8, 2021.1.6, 2022.0.6, 2022.1.7, 2023.0.3
Sources
NVD

Affected software

SoftwareAffected versions
MOVEit TransferServers and applications · cpe:a:progress:moveit_transfer
  • Every version before 2020.1.10
  • From 2021.0.6 before 2021.0.8
  • From 2021.1.4 before 2021.1.6
  • From 2022.0.4 before 2022.0.6
  • From 2022.1.5 before 2022.1.7
  • From 2023.0.1 before 2023.0.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-35708
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-35708