ACTIEF MISBRUIKT
CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability
| Leverancier | Progress |
|---|---|
| Product | MOVEit Transfer |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 2 jun 2023 |
| CISA-deadline (Amerikaanse overheid) | 23 jun 2023 |
| Gebruik door ransomware | Bekend |
| Zwakte (CWE) | CWE-89 |
Vereiste actie (tekst van CISA, Engels)
Apply updates per vendor instructions.
Beschrijving (NVD, Engels)
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
BRONNEN
Andere lekken bij Progress
- CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability
- CVE-2024-4885: Progress WhatsUp Gold Path Traversal Vulnerability
- CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability
- CVE-2024-6670: Progress WhatsUp Gold SQL Injection Vulnerability
- CVE-2024-4358: Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.