https://pwn.watch/t/moveit Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 16 Jun 2023 00:00:00 GMT https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023 https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023 Fri, 16 Jun 2023 00:00:00 GMT critical <p>Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3), Older branches: see vendor advisory</p> <p><strong>Latest updates:</strong></p><ul><li>2023-06-16: Third round of fixes for CVE-2023-35708 after a public proof of concept (<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-35708">source</a>)</li><li>2023-06-09: Progress fixes more SQL injection bugs found during code review (CVE-2023-35036) (<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-35036">source</a>)</li><li>2023-06-07: CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505) (<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-34362, CVE-2023-35036, CVE-2023-35708</p>