Detections
Analytics

CVE-2023-36934

critical

Description

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

References

https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023

https://www.greynoise.io/blog/surge-moveit-transfer-scanning-activity

https://www.infosecurity-magazine.com/news/moveit-attack-risk-scanning-surge/

https://thehackernews.com/2025/06/moveit-transfer-faces-increased-threats.html

https://www.databreachtoday.com/scans-probing-for-moveit-systems-may-be-precursor-to-attacks-a-28832

https://www.progress.com/moveit

Details

Source: Mitre, NVD

Published: 2023-07-05

Updated: 2023-07-10

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.92232

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability Being Monitored