CRITICAL CISA KEV

CVE-2023-34362

CVSS v3

9.8

CRITICAL

EPSS Score

94.3%

exploit probability

CISA KEV

Yes

known exploited

Exploitation

SSVC status

Description

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

CISA Known Exploited Vulnerability

Date Added
6/2/2023
Patch Due Date
6/23/2023
Ransomware Use
Known

Technical details

Published
6/2/2023

Frequently asked questions

What is CVE-2023-34362?

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

Is CVE-2023-34362 actively exploited?

Yes. CVE-2023-34362 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 6/23/2023.

What is the CVSS score for CVE-2023-34362?

CVE-2023-34362 has a CVSS v3 base score of 9.8 (CRITICAL severity).

Is CVE-2023-34362 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.