KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2023-34362
Progress Software · MOVEit Transfer
SQL injection vulnerability in the MOVEit Transfer web application that permitted unauthenticated privilege escalation and mass exfiltration by CL0P.
Correlated Federal Court Cases & Exploitation Context (1)
Docket CISA Advisory AA23-158A · U.S. District Court for the District of Massachusetts
MOVEit Transfer Mass Zero-Day Extortion Campaign Mass cyber extortion campaign exploiting a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software MOVEit Transfer appliances, exfiltrating personal records of over 90 million individuals across 2,700 organizations without encrypting files.
Exploitation Ground Zero: Pre-authenticated SQL injection vulnerability (CVE-2023-34362) in the web application interface of Progress Software MOVEit Transfer managed file transfer servers, allowing remote database access and arbitrary code execution.
Operational Impact: Compromised over 2,700 organizations and exposed personal records of over 95 million individuals worldwide. High-impact victims included the BBC, British Airways, Siemens Energy, Shell, UCLA, and multiple US federal agencies including the Department of Energy, resulting in collective breach response and liability costs exceeding $10 billion.
Sector: Government, Financial Services, Healthcare, Technology · Loss: $1.2 billion
Inspect Full Case Dossier →
Associated Government Advisories
- AA23-158A CISA Alert →