CVE-2021-33894

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-09 · updated 2026-06-17
Weakness: CWE-89

Description

In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements.

Affected products

Progress MOVEit Transfer: before 2019.0.6; from 2019.1 before 2019.1.5; from 2019.2 before 2019.2.2; from 2020.0 before 2020.0.5; from 2020.1 before 2020.1.4; from 2021.0 before 2021.0.1 — fixed in 2019.0.6, 2019.1.5, 2019.2.2, 2020.0.5, 2020.1.4, 2021.0.1

How to fix

Upgrade to a fixed version: Progress MOVEit Transfer 2019.0.6, 2019.1.5, 2019.2.2, 2020.0.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-33894 or the next vulnerability affects your stack