CVE-2023-34362 vulnerability in Progress Products
Published on June 2, 2023
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
Known Exploited Vulnerability
This Progress MOVEit Transfer SQL Injection Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
The following remediation steps are recommended / required by June 23, 2023: Apply updates per vendor instructions.
Vulnerability Analysis
CVE-2023-34362 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
What is a SQL Injection Vulnerability?
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CVE-2023-34362 has been classified to as a SQL Injection vulnerability or weakness.
Products Associated with CVE-2023-34362
You can be notified by stack.watch whenever vulnerabilities like CVE-2023-34362 are published in these products:
What versions are vulnerable to CVE-2023-34362?
- Progress Moveit Cloud Version 15.0.0.0 Fixed in Version 15.0.2.39
- Progress Moveit Cloud Fixed in Version 14.0.5.45
- Progress Moveit Cloud Version 14.1.0.0 Fixed in Version 14.1.6.97
- Progress Moveit Transfer Version 2023.0.0 Fixed in Version 2023.0.2
- Progress Moveit Transfer Version 2022.1.0 Fixed in Version 2022.1.6
- Progress Moveit Transfer Version 2022.0.0 Fixed in Version 2022.0.5
- Progress Moveit Transfer Version 2021.1.0 Fixed in Version 2021.1.5
- Progress Moveit Transfer Fixed in Version 2021.0.7