CVE-2023-34362

Progress MOVEit Transfer SQL Injection

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 99.9%

Published2 Jun 2023
Added to CISA KEV2 Jun 2023
Remediation due23 Jun 2023

Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.

Added to KEV: 2 Jun 2023Federal remediation due: 23 Jun 2023Used in ransomware

Description

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Progress Moveit Cloud≥ 14.1.0.0 < 14.1.6.97 · ≥ 15.0.0.0 < 15.0.2.39 · < 14.0.5.45

Progress Moveit Transfer≥ 2021.1.0 < 2021.1.5 · ≥ 2022.0.0 < 2022.0.5 · ≥ 2022.1.0 < 2022.1.6 · ≥ 2023.0.0 < 2023.0.2

Remediation

Fixed in

Progress Moveit Cloud≥ 14.1.6.97

Progress Moveit Transfer≥ 2021.1.5

Patch & vendor advisories

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

References

http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.htmlExploitThird Party AdvisoryVDB Entry
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34362US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-34362 being actively exploited?

Yes. CVE-2023-34362 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2 Jun 2023. It has been used in ransomware campaigns.

How severe is CVE-2023-34362?

CVE-2023-34362 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 99.9% probability of exploitation.

Which products are affected by CVE-2023-34362?

Affected products include Progress Moveit Cloud, Progress Moveit Transfer.

How do I fix CVE-2023-34362?

Upgrade affected software to a fixed version, for example Progress Moveit Cloud 14.1.6.97, Progress Moveit Transfer 2021.1.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-34362 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.