Descripción
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
Acción recomendada
Aplicar las actualizaciones según las instrucciones del fabricante.
Referencias
- This CVE has a CISA AA located here: . Please see the AA for associated IOCs. Additional information is available at: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023. cisa.gov/news-events/cybersecurity-advisories/aa23-158a
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2023-34362
Otras vulnerabilidades de Progress en el catálogo
- CVE-2026-8037 Vulnerabilidad de inyección de comandos en Progress LoadMaster Alta 07-08-2026
- CVE-2024-4885 Vulnerabilidad de recorrido de directorios (path traversal) en Progress WhatsUp Gold Alta 03-03-2025
- CVE-2024-1212 Progress Kemp LoadMaster OS Command Injection Vulnerability Alta 18-11-2024
- CVE-2024-6670 Progress WhatsUp Gold SQL Injection Vulnerability Alta 16-09-2024
- CVE-2024-4358 Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability Alta 13-06-2024