Brand ClaimErleben, was verbindet

Information on the use of cookies

This website uses only the technically necessary cookies to provide you with the best possible service.
Your session is identified by a so-called session cookie in order to maintain your language choice and to allow a comfortable form use. Furthermore, a login is only possible by using a cookie.
Further information can be found in the data protection information.

Accept

Advisory 2023-1146 - Progress Software MOVEit: Vulnerability allows SQL Injection

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2023-1146
Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.
5
Attack probability
high
4
Potential damage
medium-high
remote anonymous attackerExploit available
Date
2023-06-02
Release
2023-06-02

Operating System

  • Windows

Software

  • Progress Software MOVEit < 2021.0.6
  • Progress Software MOVEit < 2021.1.4
  • Progress Software MOVEit < 2022.0.4
  • Progress Software MOVEit < 2022.1.5
  • Progress Software MOVEit < 2023.0.1

Attack

A remote anonymous attacker can exploit a vulnerability in Progress Software MOVEit in order to manipulate data.

Description

Progress MOVEit is secure managed file transfer (MFT) software that provides visibility and control over file transfer activities.

CVE-2023-34362

There is a vulnerability in Progress Software MOVEit. This is an SQL injection in the MOVEit Transfer web application that allows unauthorized access to the MOVEit Transfer database. A remote, anonymous attacker can exploit this vulnerability to derive information about the structure and contents of the database and execute SQL statements that modify or delete database elements.

CVSSv2 Base Score: 8.8 / Temporal Score: 7.3
AV:N/AC:M/AU:N/C:C/I:C/A:N/E:F/RL:OF/RC:ND
CVSSv3.1 Base Score: 9.1 / Temporal Score: 8.4
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:X

According to reports, this vulnerability is already being actively exploited.

Recommendation

Progress provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

Information

Progress Advisory dated 2023-06-01
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

BSI IT Security Warning
https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2023/2023-240133-1000.pdf?__blob=publicationFile&v=3

References

CVE:CVE-2023-34362
PROGRESS:000234532

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.