Your Cart Is Empty
✖No products in the cart.
control of the application and access sensitive data.
The first vulnerability, CVE-2020-27223, has a CVSS score of 9.1 and exists due to insufficient input validation in the ‘FileID’ parameter. Attackers can exploit this vulnerability by manipulating the parameter to insert malicious SQL queries, resulting in the application executing unauthorized SQL commands.
The second vulnerability, CVE-2020-27224, has a CVSS score of 8.8 and exists due to insufficient input validation in the ‘FileName’ parameter. Attackers can exploit this vulnerability by injecting SQL queries via the parameter, potentially allowing them to execute unauthorized SQL commands to gain access to the database.
Progress Software advises all customers to upgrade to the latest version of the MOVEit Transfer software to address these vulnerabilities. In addition, the company recommends that users limit access to the MOVEit Transfer web interface to trusted parties through the use of firewalls or other access control mechanisms.
So, what does this mean for MOVEit Transfer users? Well, essentially, there are two SQL injection vulnerabilities that could result in an attacker gaining control over the application and accessing sensitive information. Luckily, patches have been released to address these vulnerabilities, and users are strongly recommended to upgrade to the latest version of the software as soon as possible. To prevent unauthorized access, users should also consider limiting access to the web interface to trusted parties through the use of firewalls or other access control mechanisms.Original Article: https://thehackernews.com/2023/06/new-critical-moveit-transfer-sql.html
No products in the cart.