www.darkreading.com
Open in
urlscan Pro
2606:4700::6811:7563
Public Scan
URL:
https://www.darkreading.com/endpoint/moveit-transfer-another-critical-data-theft-bug
Submission: On July 15 via api from US — Scanned from DE
Submission: On July 15 via api from US — Scanned from DE
Form analysis
0 forms found in the DOMText Content
The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Black Hat USA - August 5-10 - Learn More Webinars * State of DDoS: Mid-Year Threat Report Jul 19, 2023 * Finding a Backup Strategy That Works For You Jul 26, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > Newsletter Sign-Up The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Black Hat USA - August 5-10 - Learn More Webinars * State of DDoS: Mid-Year Threat Report Jul 19, 2023 * Finding a Backup Strategy That Works For You Jul 26, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Black Hat USA - August 5-10 - Learn More Webinars * State of DDoS: Mid-Year Threat Report Jul 19, 2023 * Finding a Backup Strategy That Works For You Jul 26, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > -------------------------------------------------------------------------------- Newsletter Sign-Up SEARCH A minimum of 3 characters are required to be typed in the search bar in order to perform a search. Announcements 1. 2. 3. Event How to Launch a Threat Hunting Program | Webinar <REGISTER> Event How to Accelerate XDR Outcomes: Bridging the Gap Between Network and Endpoint | Webinar <REGISTER> Report Black Hat USA 2022 Attendee Report | Supply Chain & Cloud Security Risks Are Top of Mind | <READ IT NOW> PreviousNext Endpoint 1 MIN READ Quick Hits MOVEIT TRANSFER FACES ANOTHER CRITICAL DATA-THEFT BUG Users need to patch the latest SQL injection vulnerability as soon as possible. Meanwhile, Cl0p's data extortion rampage gallops on. Dark Reading Staff Dark Reading July 07, 2023 Source: Federico Caputo via Alamy Stock Photo PDF Yet another critical SQL injection vulnerability has been disclosed and patched in Progress Software's MOVEit Transfer software — the fourth such flaw revealed in the space of a month. The security bug (CVE-2023-36934) is distinct from the former zero-day flaw that's being exploited with resounding success by the Cl0p ransomware gang. But like that bug, it could allow unauthenticated cyberattackers to access MOVEit Transfer databases, and from there execute malware, manipulate files, or exfiltrate information. "An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which could result in modification and disclosure of MOVEit database content," according to the Progress advisory on the bug. The flaw hasn't been exploited in the wild so far, according to the advisory — but given its severity, users are urged to patch it as soon as possible, along with two high-severity vulnerabilities (CVE-2023-36932 and CVE-2023-36933) disclosed at the same time. The bugs affect MOVEit Transfer versions 12.1.10 and earlier, 13.0.8 and earlier, 13.1.6 and earlier, 14.0.6 and earlier, 14.1.7 and earlier, and 15.0.3 and earlier. The other SQL vulnerabilities revealed since early June are CVE-2023-35708 and CVE-2023-35036, as well as CVE-2023-34362, which is Cl0p's target and was discovered Memorial Day weekend. Speaking of the Cl0p campaign, the extortion gang is galloping on, claiming 200+ victims so far, including government agencies. The blast radius of the campaign has been widened by compromised third-party vendors exposing their downstream customers. Progress said this week that it plans to release MOVEit product updates every two months from now on. Vulnerabilities/ThreatsApplication Security Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. Subscribe More Insights White Papers * 9 Traits You Need to Succeed as a Cybersecurity Leader * Rediscovering Your Identity More White Papers Webinars * State of DDoS: Mid-Year Threat Report * Finding a Backup Strategy That Works For You More Webinars Reports * Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware * Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks More Reports Editors' Choice Microsoft Teams Exploit Tool Auto-Delivers Malware Jai Vijayan, Contributing Writer, Dark Reading Meta's Rush to Topple Twitter Sets Up Looming Privacy Debate Nate Nelson, Contributing Writer, Dark Reading Microsoft Can Fix Ransomware Tomorrow Adam Shostack, Leading expert in threat modeling MOVEit Transfer Faces Another Critical Data-Theft Bug Dark Reading Staff, Dark Reading Webinars * State of DDoS: Mid-Year Threat Report * Finding a Backup Strategy That Works For You More Webinars Reports * Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware * Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks * How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment * The 10 Most Impactful Types of Vulnerabilities for Enterprises Today * The Promise and Reality of Cloud Security More Reports White Papers * 9 Traits You Need to Succeed as a Cybersecurity Leader * Rediscovering Your Identity * 2023 Global Future of Cyber Report * Cybersecurity in a post pandemic world: A focus on financial services * Know your customer: Enable a 360-degree view with customer identity & access management More White Papers Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Black Hat USA - August 5-10 - Learn More More Events More Insights White Papers * 9 Traits You Need to Succeed as a Cybersecurity Leader * Rediscovering Your Identity More White Papers Webinars * State of DDoS: Mid-Year Threat Report * Finding a Backup Strategy That Works For You More Webinars Reports * Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware * Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks More Reports DISCOVER MORE FROM INFORMA TECH * Interop * InformationWeek * Network Computing * ITPro Today * Data Center Knowledge * Black Hat * Omdia WORKING WITH US * About Us * Advertise * Reprints FOLLOW DARK READING ON SOCIAL * * * * * * * Home * Cookies * Privacy * Terms Copyright © 2023 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG. Cookies Button ABOUT COOKIES ON THIS SITE We and our partners use cookies to enhance your website experience, learn how our site is used, offer personalised features, measure the effectiveness of our services, and tailor content and ads to your interests while you navigate on the web or interact with us across devices. You can choose to accept all of these cookies or only essential cookies. To learn more or manage your preferences, click “Settings”. For further information about the data we collect from you, please see our Privacy Policy Accept All Settings COOKIE PREFERENCE CENTER When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information Allow All MANAGE CONSENT PREFERENCES STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details FUNCTIONAL COOKIES Functional Cookies These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Cookies Details TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details Back Button BACK Search Icon Filter Icon Clear checkbox label label Apply Cancel Consent Leg.Interest checkbox label label checkbox label label checkbox label label * View Cookies * Name cookie name Confirm My Choices