CVE-2023-34362

Published Jun 2, 2023

Last updated 4 months ago

Exploit known CVSS critical 9.8

Mysql

web application

Zero-day

API

SQL injection

Database

Overview

Description: In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
Source: cve@mitre.org
NVD status: Analyzed
Products: moveit_cloud, moveit_transfer

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Progress MOVEit Transfer SQL Injection Vulnerability
Exploit added on: Jun 2, 2023
Exploit action due: Jun 23, 2023
Required action: Apply updates per vendor instructions.

Weaknesses

nvd@nist.gov: CWE-89
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:progress:moveit_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D85743D1-EE56-41E4-8896-A5DC28401E2E",
            "versionEndExcluding": "14.0.5.45",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:progress:moveit_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "62ED1272-C70C-44D1-83B6-E17DBAEA9726",
            "versionEndExcluding": "14.1.6.97",
            "versionStartIncluding": "14.1.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:progress:moveit_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "068258A3-1310-41B7-8754-C3503961151F",
            "versionEndExcluding": "15.0.2.39",
            "versionStartIncluding": "15.0.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B1B9DBBF-87E1-4FAF-93C7-6F5D779850C3",
            "versionEndExcluding": "2021.0.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F3B434F7-78C3-4B03-8E85-9E6E86007135",
            "versionEndExcluding": "2021.1.5",
            "versionStartIncluding": "2021.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "82CDAEC0-D7A8-4271-8C5F-84555B36F8A4",
            "versionEndExcluding": "2022.0.5",
            "versionStartIncluding": "2022.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "305DD3BE-0D3B-4298-ADCC-B41D48153106",
            "versionEndExcluding": "2022.1.6",
            "versionStartIncluding": "2022.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AFC2755D-6FBB-4B43-8A34-55327DCA7FAB",
            "versionEndExcluding": "2023.0.2",
            "versionStartIncluding": "2023.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References