CVE-2023-36934

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023Patch, Release Notes, Third Party Advisory
https://www.progress.com/moveitProduct
https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023Patch, Release Notes, Third Party Advisory
https://www.progress.com/moveitProduct

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-369366.1Cross-Site Scripting (XSS) vulnerability in PHPGurukul Online Security Guards Hiring System using PHP and MySQL 1.0 allows attackers to exec CVE-2023-369396.1Cross-Site Scripting (XSS) vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload CVE-2023-36949.8A vulnerability, which was classified as critical, has been found in SourceCodester/projectworlds House Rental and Property Listing 1.0. Thi CVE-2023-369404.8Cross Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL v.1.2 allows attackers to execute ar CVE-2023-369416.1A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute ar CVE-2023-369426.1A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute ar CVE-2023-369479.8TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File pa CVE-2023-36959.8A vulnerability classified as critical has been found in Campcodes Beauty Salon Management System 1.0. Affected is an unknown function of th CVE-2023-369509.8TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_ho CVE-2023-369529.8TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.CVE-2023-369539.8TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.CVE-2023-369549.8TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.