MOVEit Transfer, the software at the center of the recent massive wave of Clop ransomware breaches, has received an update that fixes a critically severe SQL injection bug and two other less severe vulnerabilities.

SQL injection vulnerabilities allow attackers to create special requests to access a database or to tamper with it by executing code. For these attacks to be possible, the target application must suffer from a lack of proper input/output data sanitization.

Progress, the developer of MOVEit Transfer, discovered several SQL injection issues in their product, including a critical one identified as CVE-2023-36934, which can be exploited without user authentication.

“A SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database”, reads the Progress security bulletin.

The second SQL injection flaw is identified as CVE-2023-36932 and was given a high severity rating because an attacker could exploit it after authentication.

The two SQL injection security issues affect multiple versions of MOVEit Transfer, including 12.1.10 and earlier, 13.0.8 and earlier, 13.1.6 and earlier, 14.0.6 and earlier, 14.1.7 and earlier versions and 15.0.3 and earlier. .

A third vulnerability addressed with this patch is CVE-2023-36933, a high-severity issue that allows attackers to cause the program to terminate unexpectedly.

This flaw affects MOVEit Transfer versions 13.0.8 and earlier, 13.1.6 and earlier, 14.0.6 and earlier, 14.1.7 and earlier, and 15.0.3 and earlier.

MOVEit Transfer users are recommended to upgrade to the versions highlighted in the table below, which fix the mentioned vulnerabilities.

Progress Adopts Security Service Packs

About a month ago, the Piratesin particular the Clop ransomware gangmassively exploited a zero-day vulnerability in the MOVEit Transfer product, identified as CVE-2023-34362, to steal data from large organizations global.

The software vendor patched the flaw a few days after it was discovered, but it was revealed that the patches were coming around two years after the start of the first exploitation in the wild.

Progress launched a security audit soon after, which led to the discovery and application of fixes Additional Critical Severity Rifts.

While the American software company is still dealing with the massive repercussions of the security incident, it has decided to introduce regular security updates called “Service Packs”, released monthly.

As part of this new approach, the software upgrade process is streamlined, allowing MOVEit Transfer administrators to apply patches faster and easier than before.