VDB
BDU%3A2023-03174
BDU%3A2023-03174
PUBLISHED
CVSS 10 CRITICAL
Уязвимость программного обеспечения для обработки и передачи конфиденциальных данных Progress MOVEit Transfer, связанная с непринятием мер по защите структуры запроса SQL, позволяющая нарушителю повысить свои привилегии
Risk Scores
CVSS 2.0
10
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | MOVEit Transfer, MOVEit Cloud | |
| n/a | n/a | n/a |
| progress | moveit_cloud | 14.1.0.0, 14.0.5.45 |
| progress | moveit_transfer | 2021.1.0, 2022.0.0, 2022.1.0 |
Timeline
- Jun 1, 2023 PoC Published
- Jun 3, 2023 PoC Published
- Jun 8, 2023 PoC Published
- Jun 8, 2023 PoC Published
- Jun 14, 2023 PoC Published
- Jun 16, 2023 CVE Published
- Jun 21, 2023 PoC Published
- Jun 22, 2023 PoC Published
- Jul 15, 2023 PoC Published
- Sep 1, 2023 PoC Published
- Dec 11, 2023 PoC Published
- Mar 1, 2024 PoC Published
References
- https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023 advisory
- https://github.com/horizon3ai/CVE-2023-34362 url
- https://www.rapid7.com/db/vulnerabilities/progress-moveit-transfer-critical-may-2023/ url
- https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv url
- http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html url
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34362 url
- http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html url