CVE-2021-37614

In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.7 (11.0.7), 2019.1.6 (11.1.6), 2019.2.3 (11.2.3), 2020.0.6 (12.0.6), 2020.1.5 (12.1.5), and 2021.0.3 (13.0.3).

• CWE-89

• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-2021Patch, Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htmRelease Notes, Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2020/ReleaseNotes/en/index.htm#50951.htmRelease Notes, Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm#link8Vendor Advisory
• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-2021Patch, Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htmRelease Notes, Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2020/ReleaseNotes/en/index.htm#50951.htmRelease Notes, Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm#link8Vendor Advisory

Published

Aug 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37604In version 6.5 of Microchip MiWi software and all previous v…7.5
• CVE-2021-37605In version 6.5 Microchip MiWi software and all previous vers…7.5
• CVE-2021-37606Meow hash 0.5/calico does not sufficiently thwart key recove…5.3
• CVE-2021-37608Unrestricted Upload of File with Dangerous Type vulnerabilit…9.8
• CVE-2021-3761Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 …7.5
• CVE-2021-37613Stormshield Network Security (SNS) 1.0.0 through 4.2.3 allow…6.5
• CVE-2021-37615Exiv2 is a command-line utility and C++ library for reading,…5.5
• CVE-2021-37616Exiv2 is a command-line utility and C++ library for reading,…5.5
• CVE-2021-37617The Nextcloud Desktop Client is a tool to synchronize files …7.3
• CVE-2021-37618Exiv2 is a command-line utility and C++ library for reading,…5.5
• CVE-2021-37619Exiv2 is a command-line utility and C++ library for reading,…5.5
• CVE-2021-3762A directory traversal vulnerability was found in the ClairCo…9.8