What is the GHSA ID for CVE-2023-34362?

GitHub tracks CVE-2023-34362 as GHSA-hq22-q5g8-577g.

What is the CVSS score of CVE-2023-34362?

CVE-2023-34362 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Is CVE-2023-34362 exploited in the wild?

CISA lists it as a known exploited vulnerability (added 2 Jun 2023). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.93% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

CVE-2023-34362GHSA-hq22-q5g8-577g

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022....

CVE-2023-34362 (GitHub advisory GHSA-hq22-q5g8-577g) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.8, classed as Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89). No affected-package or version data has been published, so its fix status is unknown. CISA lists it as a known exploited vulnerability (added 2 Jun 2023).

Critical9.8Known exploitedFix status unknownUnreviewed advisory

Published 2 Jun 2023Updated 22 Oct 2025

9.8CriticalCVSS 3.1

CVE ID: CVE-2023-34362
GHSA ID: GHSA-hq22-q5g8-577g
EPSS: 99.93%higher than 99.9% of CVEs
Weakness (CWE): CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
KEV status: Known exploitedAdded 2 Jun 2023
Published: 2 Jun 2023
Updated: 22 Oct 2025
Assigned by (CNA): mitre

Summary

Source: GitHub Advisory Database

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Critical9.8Base score from GitHub Advisory Database

Attack Vector AV: Network
Attack Complexity AC: Low
Privileges Required PR: None
User Interaction UI: None
Scope S: Unchanged
Confidentiality C: High
Integrity I: High
Availability A: High

CISA SSVC decision points

Exploitation: active; Exploited in the wild
Automatable: yes; Attackers can automate this at scale
Technical impact: total; Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

CISA required action

Apply updates per vendor instructions.

Federal agencies must remediate by 23 Jun 2023. Used in ransomware campaigns.

Affected packages

Source: CVE.org

No affected packages have been published. The vendor may describe affected products only in prose (see the summary).

Fix

Source: CVE.org

Fix status unknown

The sources CVEminer reads publish no affected-package or version data for this vulnerability, so it can't tell whether a fix exists. Check the vendor advisory in the references below.

Vulnerability intelligence

References

Advisories 2

Questions about CVE-2023-34362

What is the GHSA ID for CVE-2023-34362?: GitHub tracks CVE-2023-34362 as GHSA-hq22-q5g8-577g.
What is the CVSS score of CVE-2023-34362?: CVE-2023-34362 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How do I fix CVE-2023-34362?: No affected-package or version data has been published, so its fix status is unknown.
Is CVE-2023-34362 exploited in the wild?: CISA lists it as a known exploited vulnerability (added 2 Jun 2023). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.93% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

Data sources

Upstream records

OSV (GitHub advisory)No record
GitHub Advisory DatabaseLoadedRaw JSON
OSV (CVE record)No record
CVE.orgLoaded
CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 14:00 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description: GitHub Advisory Database
Severity score: GitHub Advisory Database
Weakness (CWE): GitHub Advisory Database
Affected packages: CVE.org
Fix: CVE.org
References: Computed by CVEminer
SSVC: CVE.org
KEV status: CISA KEV catalog
EPSS: GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.