# CVE-2023-34362: In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022....

> CVE-2023-34362 (GitHub advisory GHSA-hq22-q5g8-577g) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.8, classed as Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89). No affected-package or version data has been published, so its fix status is unknown. CISA lists it as a known exploited vulnerability (added 2 Jun 2023).

Canonical page: https://cveminer.com/vulnerabilities/CVE-2023-34362

| Field | Value |
| --- | --- |
| CVE | CVE-2023-34362 |
| GHSA | GHSA-hq22-q5g8-577g |
| Severity | Critical |
| CVSS 3.1 | 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| EPSS | 99.93% (higher than 99.9% of CVEs) |
| CISA KEV | Listed 2 Jun 2023, due 23 Jun 2023 |
| SSVC | exploitation active, automatable yes, technical impact total |
| Published | 2 Jun 2023 |
| Modified | 22 Oct 2025 |

## Description

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS.

## Questions

**What is the GHSA ID for CVE-2023-34362?**

GitHub tracks CVE-2023-34362 as GHSA-hq22-q5g8-577g.

**What is the CVSS score of CVE-2023-34362?**

CVE-2023-34362 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

**How do I fix CVE-2023-34362?**

No affected-package or version data has been published, so its fix status is unknown.

**Is CVE-2023-34362 exploited in the wild?**

CISA lists it as a known exploited vulnerability (added 2 Jun 2023). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.93% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2023-34362 (advisory)
- https://github.com/advisories/GHSA-hq22-q5g8-577g (advisory)
- https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
- http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34362

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2023-34362), compiled from GitHub Advisory Database, CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.