ClosedPatched
Day · Jun 16, 2023
MOVEit Transfer zero-day: Cl0p mass data theft
Progress MOVEit Transfer
Updates on Jun 16, 2023
Third round of fixes for CVE-2023-35708 after a public proof of concept
Source
Summary
Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.
Read the full incident →Advisories6
- MOVEit Transfer Critical Vulnerability (May 2023)Progress · May 31, 2023
- #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A)CISA · Jun 7, 2023
- NVD: CVE-2023-34362NVD
- NVD: CVE-2023-35036NVD
- NVD: CVE-2023-35708NVD
- CISA Known Exploited Vulnerabilities CatalogCISA · Jun 2, 2023
