PT-2023-3209 · Ipswitch · Moveit Transfer

Published

2023-06-15

·

Updated

2026-02-09

·

CVE-2023-35708

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2021.0.8 (13.0.8) MOVEit Transfer versions prior to 2021.1.6 (13.1.6) MOVEit Transfer versions prior to 2022.0.6 (14.0.6) MOVEit Transfer versions prior to 2022.1.7 (14.1.7) MOVEit Transfer versions prior to 2023.0.3 (15.0.3)
Description A SQL injection flaw exists in the MOVEit Transfer web application. This issue allows an unauthenticated attacker to potentially gain unauthorized access to the MOVEit Transfer database. An attacker can submit a specially crafted payload to a MOVEit Transfer application endpoint, which could lead to modification and disclosure of database content. The Clop ransomware group exploited this flaw, resulting in breaches at companies like TSMC. The vulnerability stems from a lack of protective measures for the structure of SQL queries.
Recommendations Update MOVEit Transfer to version 2021.0.8 (13.0.8) or later. Update MOVEit Transfer to version 2021.1.6 (13.1.6) or later. Update MOVEit Transfer to version 2022.0.6 (14.0.6) or later. Update MOVEit Transfer to version 2022.1.7 (14.1.7) or later. Update MOVEit Transfer to version 2023.0.3 (15.0.3) or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-03329
CVE-2023-35708

Affected Products

Moveit Transfer