UpHeron
All vulnerabilities

Servers and applications

CVE-2021-38159

In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or…

Severity
Critical 9.8
Published
7 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2019.0.8, 2019.1.7, 2019.2.4, 2020.0.7, 2020.1.6, 2021.0.4
Sources
NVD

Affected software

SoftwareAffected versions
MOVEit TransferServers and applications · cpe:a:progress:moveit_transfer
  • Every version before 2019.0.8
  • From 2019.1 before 2019.1.7
  • From 2019.2 before 2019.2.4
  • From 2020.0 before 2020.0.7
  • From 2020.1 before 2020.1.6
  • From 2021.0 before 2021.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-38159
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-38159