ClosedPatched
Day · May 27, 2023
MOVEit Transfer zero-day: Cl0p mass data theft
Progress MOVEit Transfer
Updates on May 27, 2023
Earliest exploitation of the MOVEit Transfer zero-day seen by Mandiant
Source
Summary
Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.
Read the full incident →Advisories6
- MOVEit Transfer Critical Vulnerability (May 2023)Progress · May 31, 2023
- #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A)CISA · Jun 7, 2023
- NVD: CVE-2023-34362NVD
- NVD: CVE-2023-35036NVD
- NVD: CVE-2023-35708NVD
- CISA Known Exploited Vulnerabilities CatalogCISA · Jun 2, 2023
