SECUFOCUSNOW
Home›CVE index›CVE-2023-34362
CISA KEV · Known exploitedCritical

CVE-2023-34362

Progress MOVEit Transfer

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild i...

CVSS
9.8
EPSS
99.9%
100.0% percentile
CISA KEV
Listed
Published
2023.06.02
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability99.9%
Technical severityCVSS 9.8

Vulnerability overview

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild i...

Affected product and versions

Product
Progress MOVEit Transfer
Affected versions
2020.1, 2021.0, 2021.1.0, 2022.0.0, 2022.1.0, 2023.0.0, 14.1.0.0, 14.0.5.45, < 14.0.5.45, >= 14.1.0.0 < 14.1.6.97, >= 15.0.0.0 < 15.0.2.39, < 2021.0.7, >= 2021.1.0 < 2021.1.5, >= 2022.0.0 < 2022.0.5, >= 2022.1.0 < 2022.1.6, >= 2023.0.0 < 2023.0.2
Fixed versions
14.0.5.45, 14.1.6.97, 15.0.2.39, 2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6, 2023.0.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply updates per vendor instructions.

Due date: 2023.06.23
  1. 1
    Identify

    Confirm that Progress MOVEit Transfer and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-89
KEV added
2023.06.02
Ransomware use
확인됨
CVE-2023-34362 — Progress MOVEit Transfer | SECUFOCUS NOW