Info Security Magazine6 Jun 2023
Critical Zero-Day Flaw Exploited in MOVEit Transfer
The vulnerability (CVE-2023-34362) can grant escalated privileges and unauthorized access
Actively exploited vulnerability
CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
CISA KEV source
2 Jun 2023 added
23 Jun 2023 remediation due
Affected product
Progress ยท MOVEit Transfer
Known ransomware use: Known
Required action
Follow the source advisory and validate exposure in your environment.
Apply updates per vendor instructions.
Related Yasna coverage
Recent reporting that mentions CVE-2023-34362.