vulnerability
Progress MOVEit Transfer: CVE-2021-37614: Improper Neutralization of Special Elements used in an SQL Command
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:S/C:P/I:P/A:P) | Aug 5, 2021 | Dec 13, 2024 | Feb 11, 2026 |
Severity
7
CVSS
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
Published
Aug 5, 2021
Added
Dec 13, 2024
Modified
Feb 11, 2026
Description
In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.7 (11.0.7), 2019.1.6 (11.1.6), 2019.2.3 (11.2.3), 2020.0.6 (12.0.6), 2020.1.5 (12.1.5), and 2021.0.3 (13.0.3).
Solution
progress-moveit-transfer-upgrade-latest
References
- CVE-2021-37614
- https://attackerkb.com/topics/CVE-2021-37614
- URL-https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-2021
- URL-https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm
- URL-https://docs.ipswitch.com/MOVEit/Transfer2020/ReleaseNotes/en/index.htm#50951.htm
- URL-https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm#link8
- CWE-89
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.