Summary
generated automatically from NVD dataProgress MOVEit Transfer contains SQL injection flaws (CWE-89) in its web application, affecting releases earlier than 2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6 and 2023.0.2. An unauthenticated attacker could send a crafted payload to an application endpoint and gain unauthorized access to the database, allowing its content to be modified and disclosed. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.1.
NVD description
In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
EPSS · FIRST.org
12.8%probability of exploitation in the next 30 days
Higher than 96% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 12 juin 2023
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (4)
- https://archive.is/58ty7Third Party Advisory
- https://archive.is/58ty7Third Party Advisory
Similar CVEs
Other vulnerabilities of type CWE-89
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.