Contact us

Insights & Resources

•

Zero Day Exploit in MOVEit Transfer

Filed under

A critical security vulnerability has recently come to light and poses a significant risk to organizations using MOVEit Transfer, the managed file transfer software developed by Ipswitch.

A zero day exploit, CVE-2023-34362, is actively being exploited by malicious hackers to steal sensitive data from targeted organizations. Breaches are already being reported world-wide, and it is essential to take immediate action to protect your data if this CVE is present in your environment.

The vulnerability allows for escalated privileges and potential unauthorized access to MOVEit Transfer. While specific details have not been publicly disclosed, it is believed to be a web-facing vulnerability, possibly a SQL injection vulnerability leading to remote code execution.

Patches are still being developed for some versions of MOVEit, but some patches are available today. At a minimum, we recommend doing your own research and reviewing your logging and security alerting systems immediately to ensure everything is working properly to protect your assets.

Below is the current list of MOVEit Transfer versions that have a patch available:

Affected VersionFixed VersionDocumentation
MOVEit Transfer 2023.0.0MOVEit Transfer 2023.0.1MOVEit 2023 Upgrade Documentation
MOVEit Transfer 2022.1.xMOVEit Transfer 2022.1.5MOVEit 2022 Upgrade Documentation
MOVEit Transfer 2022.0.xMOVEit Transfer 2022.0.4
MOVEit Transfer 2021.1.xMOVEit Transfer 2021.1.4MOVEit 2021 Upgrade Documentation
MOVEit Transfer 2021.0.xMOVEit Transfer 2021.0.6

For questions or more information, please reach out to your FD advisor.

Explore related insights

Explore Insights & Resources