CVE-2023-35708

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 96.68%
EPSS Percentile: 99.89%
CISA KEV: Not listed

Description

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 16-Jun-2023 11:15
Last Modified: 17-Jun-2026 13:05
EPSS Date: 2026-10-18
CWE: CWE-89

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

progress / moveit_transfer
Version / affected range: * · before (exclusive) 2020.1.10
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2021.0.6 · before (exclusive) 2021.0.8
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2021.1.4 · before (exclusive) 2021.1.6
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2022.0.4 · before (exclusive) 2022.0.6
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2022.1.5 · before (exclusive) 2022.1.7
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
progress / moveit_transfer
Version / affected range: * · from (inclusive) 2023.0.1 · before (exclusive) 2023.0.3
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*

References

Last enrichment sync: 19-Oct-2026 02:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

going back as far as 2021. Shortly afterward, two additional vulnerabilities (CVE-2023-35036 and CVE-2023-35708) crashed the scene with SQL injection issues. Despite MOVEit's relatively rare presence in the Wiz Recaps Its 2023 Cloud Security Stories and Key Lessons
On June 15, 2023, Progress published details of a third critical SQL injection vulnerability in MOVEit Transfer (CVE-2023-35708). MOVEit Transfer Flaws Exploited in the Wild; Progress Releases Fixes

CVE (6)

People (4)

Threat Actors (8)

MITRE ATT&CK (1)

Vendors (5)

Products (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.