MOVEit Transfer Critical Vulnerability - 20230602001¶
Overview¶
Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment.
If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted below in order to help protect your MOVEit Transfer environment.
What is the vulnerability?¶
CVE-2023-34362 - Progress MOVEit Transfer SQL Injection Vulnerability
What is vulnerable?¶
The vulnerability affects the following products:
- All MOVEit Transfer versions are affected by this vulnerability.
See the table below for the security patch for each supported version.
| Affected Version | Fixed Version | Documentation |
|---|---|---|
| MOVEit Transfer 2023.0.0 | MOVEit Transfer 2023.0.1 | MOVEit 2023 Upgrade Documentation |
| MOVEit Transfer 2022.1.x | MOVEit Transfer 2022.1.5 | MOVEit 2022 Upgrade Documentation |
| MOVEit Transfer 2022.0.x | MOVEit Transfer 2022.0.4 | MOVEit 2022 Upgrade Documentation |
| MOVEit Transfer 2021.1.x | MOVEit Transfer 2021.1.4 | MOVEit 2021 Upgrade Documentation |
| MOVEit Transfer 2021.0.x | MOVEit Transfer 2021.0.6 | MOVEit 2021 Upgrade Documentation |
A comprehensive list of recommendations, remediation steps, and Indicators of Compromise (IOCs) can be found here.
What has been observed?¶
There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
Recommendation¶
The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices and applications.