Role
Vulnerability and exposure management
Fix what attackers can reach first: see internet-facing exposure and the flaws being exploited, instead of a long scanner list.
Read more
Exploited vulnerability
MOVEit Transfer SQL injection
CVE-2023-34362
CVE-2023-34362 is the MOVEit Transfer SQL injection flaw, in Progress MOVEit Transfer, software that companies use to exchange files.
- On CISA KEV
- CVE ID
- CVE-2023-34362
- CISA KEV
- Listed
- Affected product
- MOVEit Transfer
- Exploited
- Yes
- Published
- June 2023
In short
CVE-2023-34362 is the MOVEit Transfer SQL injection flaw, in Progress MOVEit Transfer, software that companies use to exchange files. It was a zero-day, meaning attackers used it before a fix existed. CISA and the FBI attribute the mass data theft to the CL0P ransomware group, beginning on 27 May 2023.
- CVECVE-2023-34362
- ProductProgress Software MOVEit Transfer
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedInstall the fixed release · Use the advisory indicators
What it allows
An attacker with no login can reach the MOVEit Transfer database through the web application. Depending on the database engine (MySQL, Microsoft SQL Server or Azure SQL), the attacker may learn the structure and contents of the database and run SQL commands that change or delete data. CISA and the FBI say CL0P used it to install a web shell named LEMURLOOT and steal data from the databases.
Who is affected
Per NVD, MOVEit Transfer versions before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5) and 2023.0.1 (15.0.1) are affected. NVD adds that all older versions are affected too, including unsupported ones. Exploitation of unpatched systems can occur over HTTP or HTTPS.
CISA and the FBI say that beginning on 27 May 2023 the CL0P ransomware group, also known as TA505, exploited this previously unknown flaw. Internet-facing MOVEit Transfer servers were infected with the LEMURLOOT web shell, used for persistence, information gathering and data theft. The joint advisory AA23-158A notes the same actor ran similar zero-day campaigns against Accellion File Transfer Appliance devices in 2020 and 2021 and against GoAnywhere MFT servers in early 2023.
NVD published the entry on 2 June 2023 and notes exploitation in May and June 2023. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2 June 2023, with a federal due date of 23 June 2023. The KEV entry flags known use in ransomware campaigns.
Who exploits it
- Ransomware group Cl0p Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. Active · Since 2019 · Ransomware as a service, and data theft campaigns (per the advisory)
- Malware Clop Clop is ransomware for Windows that locks files and adds its own file extension. Ransomware · Since 2019 · Windows
What to do
-
Install the fixed release
Move to a MOVEit Transfer release at or above the fixed versions NVD lists, such as 2023.0.1 (15.0.1), and keep the product current. CISA's KEV action is to apply updates per vendor instructions.
-
Treat exposed servers as possibly compromised
This flaw was used before a fix existed, so patching alone does not show that nothing was taken. Review the server and its database for the LEMURLOOT web shell and for unexpected data access, using the indicators in advisory AA23-158A.
-
Use the advisory indicators
AA23-158A lists network addresses and other indicators from the MOVEit campaign. Search your web server and firewall logs for them going back to late May 2023.
-
Prioritize internet-facing known exploited flaws
CISA advises prioritizing patching of known exploited vulnerabilities in internet-facing systems, and monitoring network ports, protocols and services.
-
Limit what a file transfer server holds
Keep only the files you need on transfer servers and delete old ones. This is general practice, not a step from the advisory.
Questions
What is the MOVEit Transfer SQL injection flaw?
CVE-2023-34362 is an SQL injection flaw in Progress MOVEit Transfer, a file exchange product. An attacker with no login can reach the database through the web application and may read or change its contents.
Who exploited the MOVEit Transfer flaw?
CISA and the FBI say the CL0P ransomware group, also known as TA505, exploited it as a previously unknown flaw beginning on 27 May 2023. They installed a web shell named LEMURLOOT and stole data.
Which MOVEit Transfer versions are affected?
Per NVD, versions before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5) and 2023.0.1 (15.0.1) are affected. NVD adds that all older versions are affected too, including unsupported ones.
Is the MOVEit Transfer flaw on the CISA KEV list?
Yes. CISA added CVE-2023-34362 to the Known Exploited Vulnerabilities catalog on 2 June 2023, with a federal due date of 23 June 2023. The entry flags known use in ransomware campaigns.
In our research
- Ransomware examples: attacks, types and groups October 2026
- Top 10 Most Significant Data Breaches Publicly Listed on the Dark Web, 2023 to 2025 October 2025
- MOVEit Transfer Software Exploited Through Critical Zero Day Vulnerability 2023 June 2023
- Vulnerability and exposure management Role
- TA505 Threat group
Sources
- #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A) CISA and FBI
- CVE-2023-34362 record NIST National Vulnerability Database
- Known Exploited Vulnerabilities Catalog, CVE-2023-34362 CISA
- Known Exploited Vulnerabilities data feed CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.