Skip to content
Fencer Vulns
critical 9.8

CVE-2023-34362 kev+ ransomware in the critical feed json

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL…

published 2023-06-02 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-38442

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2023-06-02, used in ransomware
epss
99.9%
EPSS 99.9% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Metasploit, plus a Nuclei check

Summary

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • progress moveit_transfer 2020.0, 2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6, 2023.0.2

Timeline

  1. First public exploit (Metasploit exploit/windows/http/moveit_cve_2023_34362)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
3 y ago
Patch by
2023-06-23 (3 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Progress, MOVEit Transfer
CISA name
Progress MOVEit Transfer SQL Injection Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • Clop ransomware gang

reported by cisa.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1190 Exploit Public-Facing Application exploitation
  • T1059 Command and Scripting Interpreter primary impact
  • T1005 Data from Local System secondary impact
  • T1082 System Information Discovery secondary impact
  • T1105 Ingress Tool Transfer secondary impact
  • T1136 Create Account secondary impact
  • T1531 Account Access Removal secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

99.93% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • progress moveit_transfer
  • progress moveit_cloud

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.