Active exploitation of the MOVEit Transfer vulnerability — CVE-2023
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-34362 | Unauthenticated SQL Injection in Progress MOVEit Transfer | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-35036 | In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection… | 9.1 | 13% | ||
| CVE-2023-35708 | In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection… | 9.8 | 97% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5 | d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a 2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5 e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccad |
| sha256 | 48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a | ed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec4011d 48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a 2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31 |
| sha256 | 6015fed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec4011d | 9a9fe6076f370178de7b808f36135df16c4e438ef6453a39565ff2ec272 6015fed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec4011d 48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b61 |
| sha256 | 702421bcee1785d93271d311f0203da34cc936317e299575b06503945a6ea1e0 | 4-0 Win.Ransomware.Clop-6887770-0 IOCs Webshell (LemurLoot) 702421bcee1785d93271d311f0203da34cc936317e299575b06503945a6ea1e0 9d1723777de67bc7e11678db800d2a32de3bcd6c40a629cd165e3f7bbac |
| sha256 | 9d1723777de67bc7e11678db800d2a32de3bcd6c40a629cd165e3f7bbace8ead | 1bcee1785d93271d311f0203da34cc936317e299575b06503945a6ea1e0 9d1723777de67bc7e11678db800d2a32de3bcd6c40a629cd165e3f7bbace8ead 9e89d9f045664996067a05610ea2b0ad4f7f502f73d84321fb07861348f |
| sha256 | 9e89d9f045664996067a05610ea2b0ad4f7f502f73d84321fb07861348fdc24a | 3777de67bc7e11678db800d2a32de3bcd6c40a629cd165e3f7bbace8ead 9e89d9f045664996067a05610ea2b0ad4f7f502f73d84321fb07861348fdc24a d49cf23d83b2743c573ba383bf6f3c28da41ac5f745cde41ef8cd134452 |
| sha256 | b1c299a9fe6076f370178de7b808f36135df16c4e438ef6453a39565ff2ec272 | 23d83b2743c573ba383bf6f3c28da41ac5f745cde41ef8cd1344528c195 b1c299a9fe6076f370178de7b808f36135df16c4e438ef6453a39565ff2ec272 6015fed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec |
| sha256 | d49cf23d83b2743c573ba383bf6f3c28da41ac5f745cde41ef8cd1344528c195 | 9f045664996067a05610ea2b0ad4f7f502f73d84321fb07861348fdc24a d49cf23d83b2743c573ba383bf6f3c28da41ac5f745cde41ef8cd1344528c195 b1c299a9fe6076f370178de7b808f36135df16c4e438ef6453a39565ff2 |
| sha256 | e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e | 5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5 e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e |
From the original article
5 min read at blog.talosintelligence.com
Cisco Talos is monitoring recent reports of exploitation attempts against CVE-2023-34362 , a SQL injection zero-day vulnerability in the MOVEit Transfer managed file transfer (MFT) solution that has been actively targeted since late May 2023.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.