UpHeron
All vulnerabilities

Servers and applications

CVE-2023-34362

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL),…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 2 Jun 2023.

Severity
Critical 9.8
Published
2 Jun 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6, 2023.0.2
Sources
NVD

Affected software

SoftwareAffected versions
MOVEit TransferServers and applications · cpe:a:progress:moveit_transfer
  • Every version before 2021.0.7
  • From 2021.1.0 before 2021.1.5
  • From 2022.0.0 before 2022.0.5
  • From 2022.1.0 before 2022.1.6
  • From 2023.0.0 before 2023.0.2

Known exploited

CISA name
Progress MOVEit Transfer SQL Injection Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
23 Jun 2023
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-34362
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-34362