What is CVE-2023-35708?

A critical vulnerability, CVE-2023-35708, has been identified in certain versions of Progress MOVEit Transfer software, which could allow an unauthenticated attacker to gain unauthorized access to the software's database through a SQL injection. This vulnerability has a severity score of 9.8, making it a significant concern for organizations using affected versions of the software. Systems running vulnerable versions of Progress MOVEit Transfer, including those integrated with other Progress products, are at risk and should be updated to protect against potential attacks.

Who is impacted by CVE-2023-35708?

The CVE-2023-35708 vulnerability affects users of Progress MOVEit Transfer software, specifically those using versions before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3). This vulnerability is a SQL injection issue that could allow an unauthenticated attacker to gain unauthorized access to the software's database, potentially leading to the modification and disclosure of sensitive information. Users of MOVEit Transfer and MOVEit Cloud are particularly at risk and should be aware of this critical vulnerability.

What to do if CVE-2023-35708 affected you

If you're affected by the CVE-2023-35708 vulnerability, it's crucial to take immediate action to protect your environment. Follow these steps to mitigate the risk:

1. Disable all HTTP and HTTPs traffic to the MOVEit Transfer environment.

2. Modify firewall rules to deny HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443.

3. Apply the patch for the affected version of MOVEit Transfer. See the Progress Community article for more details.

4. Enable all HTTP and HTTPs traffic to the MOVEit Transfer environment after applying the patch.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-35708 vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. This SQL injection vulnerability in MOVEit Transfer web application was added on June 16, 2023. To address this issue, users must update MOVEit Transfer to the fixed versions provided and follow the recommended mitigation steps. A specific due date for taking action is not mentioned.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-89, which is an SQL injection issue in Progress MOVEit Transfer software.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Progress Community: MOVEit Transfer Critical Vulnerability – CVE-2023-35708 (June 15, 2023)

• CISA Alert: Progress Software Releases Security Advisory for MOVEit Transfer Vulnerability

• Progress Security: MOVEit Transfer and MOVEit Cloud Vulnerability