CVE-2023-35708

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 96.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-16 · updated 2026-06-17
Weakness: CWE-89

Description

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).

Affected products

Progress MOVEit Transfer: before 2020.1.10; from 2021.0.6 before 2021.0.8; from 2021.1.4 before 2021.1.6; from 2022.0.4 before 2022.0.6; from 2022.1.5 before 2022.1.7; from 2023.0.1 before 2023.0.3 — fixed in 2020.1.10, 2021.0.8, 2021.1.6, 2022.0.6, 2022.1.7, 2023.0.3

How to fix

Upgrade to a fixed version: Progress MOVEit Transfer 2020.1.10, 2021.0.8, 2021.1.6, 2022.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-35708 or the next vulnerability affects your stack