PT-2021-19530 · Ipswitch+2 · Moveit Transfer+3

Published 2021-05-18 · Updated 2021-05-25 · CVE-2021-31827

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2021.0 (13.0)

Description A SQL injection issue has been discovered in the MOVEit Transfer web application, potentially allowing an authenticated attacker to gain unauthorized access to the database. The attacker may be able to infer database structure and content information, and execute SQL statements to alter or destroy database elements, depending on the database engine used, such as MySQL, Microsoft SQL Server, or Azure SQL. The issue is located in MOVEit.DMZ.WebApp in SILHuman.vb.

Recommendations For versions prior to 2021.0 (13.0), update to version 2021.0 (13.0) or later to resolve the issue. As a temporary workaround, consider restricting access to the MOVEit Transfer web application to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-31827

Affected Products

Azure Sql

Moveit Transfer

Sql Server

Mysql Server

References · 5

• https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm · Vendor Advisory
• https://progress.com/moveit · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31827 · Vendor Advisory
• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-April-2021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31827 · Security Note