MOVEit Transfer and MOVEit Cloud Vulnerability

A new SQL injection vulnerability in the MOVEit Transfer app and MOVEit Cloud has been discovered (CVE-2023-35036)

Threat ID:: CC-4335
Threat Severity:: Medium
Published:: 14 June 2023 5:22 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

A new SQL injection vulnerability in the MOVEit Transfer app and MOVEit Cloud has been discovered (CVE-2023-35036)

Affected platforms

The following platforms are known to be affected:

Versions: 15.0.2 and prior

Progress (formerly Ipswitch) MOVEit Transfer

Versions:

Progress (formerly Ipswitch) MOVEit Cloud

Threat details

Additional Vulnerability to Progress MOVEit Transfer Critical Vulnerability

This Cyber Alert covers CVE-2023-35036, an SQL injection vulnerability identified by Progress as distinct from the previous SQL injection vulnerability referenced in CC-4326 (CVE-2023-34362).

Introduction

Progress (formerly Ipswitch) has released an additional security update and mitigations for a newly discovered vulnerability found in MOVEit Transfer and MOVEit Cloud applications. The critical vulnerability, tracked as CVE-2023-35036, could allow an unauthenticated remote attacker to gain access to the environment, and infer information about the structure and contents of the MOVEit database.

Progress have reported that CVE-2023-35036 was discovered following detailed code reviews into their products. There are no reports of this vulnerability being exploited in the wild at this time.

Remediation advice

MOVEit Transfer customers are encouraged to review the MOVEit Transfer advisory and apply relevant mitigations and updates as soon as practicable.

MOVEit Cloud customers are encouraged to review the MOVEit Cloud advisory, reflecting that all MOVEit Cloud clusters have been updated and no further action is required at this time.

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2023-35036

In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

Last edited: 15 June 2023 3:01 pm