CVE-2023-35036 — SQL Injection in Moveit Transfer

CWE-89 — SQL Injection9 documents7 sources
Severity
9.1CRITICALNVD
EPSS
33.7%
top 3.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Progress Moveit TransferPaloalto Cortex DataPaloalto Cortex XDR+7 more
Timeline
PublishedJun 12
Latest updateOct 4

Description

In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages10 packages

▶NVDprogress/moveit_transfer2021.1.0 — 2021.1.5+4
▶Palo Altopaloalto/pan-os
▶Palo Altopaloalto/prisma_sd

🔴Vulnerability Details

3
GHSA
GHSA-gcp2-7w4g-w774: In Progress MOVEit Transfer before 2021↗2023-06-12
▶
CVEList
CVE-2023-35036: In Progress MOVEit Transfer before 2021↗2023-06-12
▶
VulnCheck
Progress MOVEit Transfer Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')↗2023
▶

📋Vendor Advisories

1
Palo Alto
PAN-SA-2023-0003 Informational Bulletin: Impact of MOVEit Vulnerabilities (CVE-2023-34362, CVE-2023-35036, CVE-2023-35708)↗2023-06-16
▶

🕵️Threat Intelligence

1
Unit42
Threat Brief - MOVEit Transfer SQL Injection Vulnerabilities: CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 (Updated Oct 4)↗2023-10-04
▶
CVE-2023-35036 — SQL Injection in Moveit Transfer | cvebase