{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2023-42660",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2023-42660",
    "idYear": 2023,
    "status": "PUBLISHED",
    "publishedAt": "2023-09-20T16:04:54.432Z",
    "updatedAt": "2025-02-27T20:49:24.513Z",
    "importedAt": "2026-10-24T01:56:58.683Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "MOVEit Transfer Machine Interface SQL Injection",
      "summary": "\nIn Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.\n\n",
      "affected": [
        {
          "vendor": "Progress Software Corporation",
          "product": "MOVEit Transfer",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "2023.0.0 (15.0.0)",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2023.0.6 (15.0.6)"
            },
            {
              "version": "2022.1.0 (14.1.0)",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2022.1.9 (14.1.9)"
            },
            {
              "version": "2022.0.0 (14.0.0)",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2022.0.8 (14.0.8)"
            },
            {
              "version": "2021.1.0 (13.1.0)",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2021.1.8 (13.1.8)"
            }
          ]
        }
      ]
    }
  }
}