- Description
- In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
- Source
- cve@mitre.org
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
Data from CISA
- Vulnerability name
- Progress MOVEit Transfer SQL Injection Vulnerability
- Exploit added on
- Jun 2, 2023
- Exploit action due
- Jun 23, 2023
- Required action
- Apply updates per vendor instructions.
- Hype score
- Not currently trending
New Cleo zero-day RCE flaw exploited in data theft attacks: https://t.co/kvzZG4nL64 Hackers are exploiting a zero-day vulnerability (CVE-2023-34362) in Cleo managed file transfer software, affecting versions 5.8.0.21 and earlier. This remote code execution flaw allows data theft
@securityRSS
10 Dec 2024
47 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
**Breaking News: Hackers Exploit Zero-Day in Cleo MFT Software** Hackers are exploiting a zero-day vulnerability (CVE-2023-34362) in Cleo's managed file transfer software, including LexiCom, VLTrader, and Harmony, to breach corporate networks and steal data. The flaw affects… ht
@him_yadav
10 Dec 2024
72 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Actively exploited CVE : CVE-2023-34362
@transilienceai
21 Nov 2024
13 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
MOVEit Transfer Critical Vulnerability (May 2023) (CVE-2023-34362) - Progress Community https://t.co/3P6oEyjdpg
@RoryCGO
17 Nov 2024
22 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:progress:moveit_cloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D85743D1-EE56-41E4-8896-A5DC28401E2E",
"versionEndExcluding": "14.0.5.45"
},
{
"criteria": "cpe:2.3:a:progress:moveit_cloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62ED1272-C70C-44D1-83B6-E17DBAEA9726",
"versionEndExcluding": "14.1.6.97",
"versionStartIncluding": "14.1.0.0"
},
{
"criteria": "cpe:2.3:a:progress:moveit_cloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "068258A3-1310-41B7-8754-C3503961151F",
"versionEndExcluding": "15.0.2.39",
"versionStartIncluding": "15.0.0.0"
},
{
"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1B9DBBF-87E1-4FAF-93C7-6F5D779850C3",
"versionEndExcluding": "2021.0.7"
},
{
"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3B434F7-78C3-4B03-8E85-9E6E86007135",
"versionEndExcluding": "2021.1.5",
"versionStartIncluding": "2021.1.0"
},
{
"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82CDAEC0-D7A8-4271-8C5F-84555B36F8A4",
"versionEndExcluding": "2022.0.5",
"versionStartIncluding": "2022.0.0"
},
{
"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "305DD3BE-0D3B-4298-ADCC-B41D48153106",
"versionEndExcluding": "2022.1.6",
"versionStartIncluding": "2022.1.0"
},
{
"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AFC2755D-6FBB-4B43-8A34-55327DCA7FAB",
"versionEndExcluding": "2023.0.2",
"versionStartIncluding": "2023.0.0"
}
],
"operator": "OR"
}
]
}
]