CVE-2021-38159 — SQL Injection in Moveit Transfer

CWE-89 — SQL Injection4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
3.4%
top 12.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Progress Moveit Transfer
Timeline
PublishedAug 7
Latest updateMay 24

Description

In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit T…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDprogress/moveit_transfer2019.1 — 2019.1.7+5

🔴Vulnerability Details

2
GHSA
GHSA-ccj5-vqc3-m8pq: In certain Progress MOVEit Transfer versions before 2021↗2022-05-24
▶
CVEList
CVE-2021-38159: In certain Progress MOVEit Transfer versions before 2021↗2021-08-07
▶

💬Community

1
HackerOne
SQL Injection at https://files.palantir.com/ due to CVE-2021-38159↗2022-04-05
▶
CVE-2021-38159 — SQL Injection in Moveit Transfer | cvebase