PT-2023-5410 · Ipswitch · Moveit Transfer

Published

2023-09-20

·

Updated

2023-09-22

·

CVE-2023-40043

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2021.1.8 (13.1.8) MOVEit Transfer versions prior to 2022.0.8 (14.0.8) MOVEit Transfer versions prior to 2022.1.9 (14.1.9) MOVEit Transfer versions prior to 2023.0.6 (15.0.6)
Description A SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content. The vulnerability is related to the lack of validation of XML object sequences.
Recommendations For versions prior to 2021.1.8 (13.1.8), update to version 2021.1.8 (13.1.8) or later. For versions prior to 2022.0.8 (14.0.8), update to version 2022.0.8 (14.0.8) or later. For versions prior to 2022.1.9 (14.1.9), update to version 2022.1.9 (14.1.9) or later. For versions prior to 2023.0.6 (15.0.6), update to version 2023.0.6 (15.0.6) or later. As a temporary workaround, consider restricting access to the MOVEit Transfer web interface to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-06040
CVE-2023-40043

Affected Products

Moveit Transfer