CVE-2023-34362
CISA 기관 조치 기한: 2023-06-23
Progress MOVEit Transfer
Qualys 위협 인텔 · 심각도 5/5 · QID 378543 · Local
공개 익스플로잇
실제 공격 관측
측면이동
쉬운 악용
대량 데이터 유출
서비스 거부
악성코드 연계
웜 전파
고위험 예측
권한상승
인증 불필요
원격코드실행
랜섬웨어 연계
CISA KEV
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
KEV 필수 조치: Apply updates per vendor instructions.
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H