CVE-2023-35036

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 12.81%
EPSS Percentile: 96.25%
CISA KEV: Not listed

Description

In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 12-Jun-2023 10:15
Last Modified: 17-Jun-2026 13:04
EPSS Date: 2026-10-18
CWE: CWE-89

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

Affected Products / Versions

progress / moveit_transfer
Version / affected range: * · before (exclusive) 2021.0.7
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2021.1.0 · before (exclusive) 2021.1.5
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2022.0.0 · before (exclusive) 2022.0.5
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2022.1.0 · before (exclusive) 2022.1.6
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2023.0.0 · before (exclusive) 2023.0.2
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*

References

Last enrichment sync: 19-Oct-2026 02:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

an operation seemingly going back as far as 2021. Shortly afterward, two additional vulnerabilities (CVE-2023-35036 and CVE-2023-35708) crashed the scene with SQL injection issues. Despite MOVEit's relatively rare Wiz Recaps Its 2023 Cloud Security Stories and Key Lessons
2023, Progress published details of a second critical SQL injection vulnerability in MOVEit Transfer (CVE-2023-35036). An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which could MOVEit Transfer Flaws Exploited in the Wild; Progress Releases Fixes
A new CVE for our findings has been released as CVE-2023-35036. Huntress Recreates MOVEit Transfer Exploit Chain, Demonstrating Arbitrary Code Execution

CVE (6)

Malware (1)

People (6)

Threat Actors (9)

MITRE ATT&CK (2)

Vendors (5)

Products (9)

Tools (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.