PT-2023-3209 · Ipswitch · Moveit Transfer
CVE-2023-35708
·
Publicado
2023-06-15
·
Atualizado
2026-02-09
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MOVEit Transfer versions prior to 2021.0.8 (13.0.8)
MOVEit Transfer versions prior to 2021.1.6 (13.1.6)
MOVEit Transfer versions prior to 2022.0.6 (14.0.6)
MOVEit Transfer versions prior to 2022.1.7 (14.1.7)
MOVEit Transfer versions prior to 2023.0.3 (15.0.3)
Description
A SQL injection flaw exists in the MOVEit Transfer web application. This issue allows an unauthenticated attacker to potentially gain unauthorized access to the MOVEit Transfer database. An attacker can submit a specially crafted payload to a MOVEit Transfer application endpoint, which could lead to modification and disclosure of database content. The Clop ransomware group exploited this flaw, resulting in breaches at companies like TSMC. The vulnerability stems from a lack of protective measures for the structure of SQL queries.
Recommendations
Update MOVEit Transfer to version 2021.0.8 (13.0.8) or later.
Update MOVEit Transfer to version 2021.1.6 (13.1.6) or later.
Update MOVEit Transfer to version 2022.0.6 (14.0.6) or later.
Update MOVEit Transfer to version 2022.1.7 (14.1.7) or later.
Update MOVEit Transfer to version 2023.0.3 (15.0.3) or later.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Moveit Transfer