CVE-2023-40043highCWE-89

CVE-2023-40043: falha de alta gravidade em Progress Software Corporation MOVEit Transfer

MOVEit Transfer System Administrator SQL Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar MOVEit Transfer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.7%
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Progress Software Corporation · MOVEit Transfer
CVEs relacionadas — Progress Software Corporation MOVEit Transfer

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6218HIGHMOVEit Transfer Group Admin Privilege EscalationEPSS 0.7%CVE-2023-42660HIGHMOVEit Transfer Machine Interface SQL InjectionEPSS 0.7%CVE-2023-42656MEDIUMMOVEit Transfer Reflected XSSEPSS 0.6%CVE-2024-0396HIGHMissing Server-Side Input Validation in HTTP ParameterEPSS 0.5%CVE-2023-6217HIGHMOVEit Transfer XSS via MOVEit GatewayEPSS 0.5%