VULNERABILITY INTELLIGENCE

CVE-2023-36934

CVSS score9.1 CRITICAL

EPSS probability95.18%

CISA KEVNot currently listed

Published2023-07-05

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

Weakness classification

nvd@nist.gov: CWE-89

Primary references

cve@mitre.org — Patch, Release Notes, Third Party Advisory
cve@mitre.org — Product
af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Product