Progress · MOVEit Transfer

CVE-2023-34362

Progress MOVEit Transfer SQL Injection Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 99.9%

What it is

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

CISA: Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: June 23, 2023

Added to the CISA list: June 2, 2023
Published: June 2, 2023
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.9% in the top 0.1% of all known vulnerabilities
Weakness: CWE-89
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Progress

Added	Vulnerability	Product	Severity	Attack chance
Aug 7, 2026	Command InjectionCVE-2026-8037	LoadMaster	Critical 9.6	99.8%
Mar 3, 2025	Path TraversalCVE-2024-4885	WhatsUp Gold	Critical 9.8	99.3%
Nov 18, 2024	OS Command InjectionCVE-2024-1212	Kemp LoadMaster	Critical 10.0	95%
Sep 16, 2024	SQL InjectionCVE-2024-6670used by ransomware	WhatsUp Gold	Critical 9.8	93%
Jun 13, 2024	Authentication Bypass by SpoofingCVE-2024-4358	Telerik Report Server	Critical 9.8	97%
Oct 5, 2023	Deserialization of Untrusted DataCVE-2023-40044used by ransomware	WS_FTP Server	Critical 10.0	90%
Nov 3, 2021	Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic WeaknessCVE-2017-9248	ASP.NET AJAX and Sitefinity	Critical 9.8	75%
Nov 3, 2021	Deserialization of Untrusted DataCVE-2019-18935used by ransomware	Telerik UI for ASP.NET AJAX	Critical 9.8	99.7%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.