High severity · published Jun 9, 2021
CVE-2021-33894
In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before…
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
MOVEit Transfer · Progress
before 2019.0.6; 2019.1 before 2019.1.5; 2019.2 before 2019.2.2; 2020.0 before 2020.0.5; 2020.1 before 2020.1.4; 2021.0 before 2021.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33894
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33894
Patch
https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-June-2021
Product
https://www.progress.com/moveit
More from MOVEit Transfer
9.8
CVE-2023-34362
Progress MOVEit Transfer SQL Injection Vulnerability
9.8
CVE-2026-89073
MOVEit Transfer Access restriction bypass in OAuth authentication
9.8
CVE-2026-89068
MOVEit Transfer Authentication bypass in LDAP sign-on
9.8
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce updated account restrictions
9.8
CVE-2026-15966
Improper CORS handling in MOVEit Transfer