CVE-2023-34362
About
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
Rainforest analyst review
An unauthenticated SQL injection in the MOVEit Transfer web application lets an attacker reach the underlying database directly — and from there stage a web shell and pull files. No login, no user interaction. What turned a serious-but-ordinary SQLi into one of the defining breaches of the decade was the target: MOVEit is a managed file-transfer product, so the data behind it is exactly the sensitive, regulated, high-value material organizations move between each other — payroll, health records, government data.
The Clop ransomware group had it weaponized before most defenders had heard the CVE number, and ran it as a mass smash-and-grab against thousands of organizations at once. That’s the lesson: file-transfer appliances are a single choke point holding everyone’s crown jewels, and a pre-auth flaw in one becomes a supply-chain event. If you ran MOVEit Transfer, patching isn’t enough on its own — the exploitation window predates the fix, so you’re hunting for the human2.aspx web shell and anomalous data egress, not just closing the hole.
References
- http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html
- https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34362
Related CVEs
Frequently asked questions
What is CVE-2023-34362?
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database.
How severe is CVE-2023-34362?
CVE-2023-34362 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2023-34362 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2023-34362?
Public advisories list the following as affected: moveit cloud, moveit transfer. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-34362?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.