PT-2023-28489 · Ipswitch · Moveit Transfer
Publicado
2023-09-20
·
Atualizado
2023-09-22
·
CVE-2023-42660
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MOVEit Transfer versions prior to 2021.1.8 (13.1.8)
MOVEit Transfer versions prior to 2022.0.8 (14.0.8)
MOVEit Transfer versions prior to 2022.1.9 (14.1.9)
MOVEit Transfer versions prior to 2023.0.6 (15.0.6)
Description
A SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface, which could result in modification and disclosure of MOVEit database content.
Recommendations
For MOVEit Transfer versions prior to 2021.1.8 (13.1.8), update to version 2021.1.8 or later.
For MOVEit Transfer versions prior to 2022.0.8 (14.0.8), update to version 2022.0.8 or later.
For MOVEit Transfer versions prior to 2022.1.9 (14.1.9), update to version 2022.1.9 or later.
For MOVEit Transfer versions prior to 2023.0.6 (15.0.6), update to version 2023.0.6 or later.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Moveit Transfer