Database/Control plane, storage & DevOps
Progress MOVEit Transfer: Unauthenticated SQL injection into the web app
CVSS 9.8CVE-2023-34362Control plane, storage & DevOpsKnown exploitedcurated
Impact
Unauthenticated SQL injection into the web app -> DB access and RCE (Cl0p mass exploitation)
Who can reach it
Network (remote)
What to do
Control-plane: patch or decommission; assume data exfiltration if it was internet-facing
References
Related entries
- Citrix NetScaler ADC/Gateway: Unauthenticated remote code execution on the gateway applianceCVE-2023-3519 · Citrix NetScaler ADC/GatewayCritical
- JetBrains TeamCity: Authentication bypass leading to remote code execution on TeamCity ServerCVE-2023-42793 · JetBrains TeamCityCritical
- Acronis Cyber Infrastructure: Default passwordsCVE-2023-45249 · Acronis Cyber InfrastructureCritical
- Fortinet FortiClient EMS: Unauthenticated SQL injectionCVE-2023-48788 · Fortinet FortiClient EMSCritical
- Palo Alto PAN-OS: Management web interface authentication bypassCVE-2024-0012 · Palo Alto PAN-OSCritical
- OpenVPN (tap-windows6): Unchecked write sizeCVE-2024-1305 · OpenVPN (tap-windows6)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.