# CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability

- Exploited (CISA KEV): yes, added 2023-06-02, known ransomware use
- Published: 2023-06-02
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 99.9% (100th percentile)
- CWE: CWE-89

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2023-07-11 | 39 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2023-07-11 · new · rule 200013058
  > Added: signature 200013058 "MOVEit Transfer Privilege Escalation" (Authentication/Authorization Attacks, risk High), systems: IIS, ASP, Microsoft SQL Server, MySQL. References: CVE-2023-34362, CVE-2023-35036.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2023-08-08 · new · rule 200013058
  > Added: signature 200013058 "MOVEit Transfer Privilege Escalation" (Authentication/Authorization Attacks, risk High), systems: IIS, ASP, Microsoft SQL Server, MySQL. References: CVE-2023-35036, CVE-2023-34362.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: partial (2 of 7 requests blocked), template CVE-2023-34362, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: partial (2 of 7 requests blocked), template CVE-2023-34362, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2023-34362 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2023-34362