Skip to content
Back to search

CVE-2023-34362

CRITICAL
9.8 RansomwareNVD

Summary

generated automatically from NVD data

CVE-2023-34362 is a SQL injection flaw (CWE-89) in the web application of Progress MOVEit Transfer, affecting all versions before 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 and 2023.0.1, including older unsupported ones. An unauthenticated attacker can reach the database over HTTP or HTTPS, infer its structure and contents, and run SQL statements that alter or delete database elements, depending on the engine (MySQL, Microsoft SQL Server or Azure SQL). It is listed in the CISA KEV catalog, with known use in ransomware campaigns, and carries a CVSS v3.1 score of 9.8 (CRITICAL).

NVD description

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2023-06-02. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2023-06-23

Used in known ransomware campaigns.

EPSS · FIRST.org

99.9%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

9.8
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Information

Published
2 juin 2023
Updated
17 juin 2026
Status
Analyzed
Source
cve@mitre.org

Affected products

progress moveit cloud
Versions : 14.0.5.45, 14.1.6.97, 15.0.2.39
progress moveit transfer
Versions : 2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6, 2023.0.2

Weaknesses (CWE)

CWE-89CWE-89

References (7)

Similar CVEs

Other vulnerabilities of type CWE-89

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring