PT-2021-20356 · Ipswitch+2 · Moveit Transfer+3

Published 2021-06-09 · Updated 2021-06-22 · CVE-2021-33894

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MOVEit Transfer versions 2019.0.0 through 2019.0.5 MOVEit Transfer versions 2019.1.0 through 2019.1.4 MOVEit Transfer versions 2019.2.0 through 2019.2.1 MOVEit Transfer versions 2020.0.0 through 2020.0.4 MOVEit Transfer versions 2020.1.0 through 2020.1.3 MOVEit Transfer versions 2021.0.0

Description: A SQL injection issue exists in the MOVEit Transfer web app, specifically in SILUtility.vb within MOVEit.DMZ.WebApp. This could allow an authenticated attacker to gain unauthorized access to the database, potentially inferring database structure and contents or executing SQL statements to alter or delete database elements, depending on the database engine used, such as MySQL, Microsoft SQL Server, or Azure SQL.

Recommendations: For MOVEit Transfer versions 2019.0.0 through 2019.0.5, update to version 2019.0.6 or later. For MOVEit Transfer versions 2019.1.0 through 2019.1.4, update to version 2019.1.5 or later. For MOVEit Transfer versions 2019.2.0 through 2019.2.1, update to version 2019.2.2 or later. For MOVEit Transfer versions 2020.0.0 through 2020.0.4, update to version 2020.0.5 or later. For MOVEit Transfer versions 2020.1.0 through 2020.1.3, update to version 2020.1.4 or later. For MOVEit Transfer versions 2021.0.0, update to version 2021.0.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-33894

Affected Products

Azure Sql

Moveit Transfer

Sql Server

Mysql Server

References · 4

• https://osv.dev/vulnerability/CVE-2021-33894 · Vendor Advisory
• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-June-2021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33894 · Security Note
• https://progress.com/moveit · Vendor Advisory