CVE-2021-38159: MOVEit Transfer SQL Injection Analysis

CVE

CVE-2021-38159

Published

2022-04-05 05:01

Collected

2026-09-02 08:30

---
id: 7363
title: "CVE-2021-38159: MOVEit Transfer SQL Injection Analysis"
cve: CVE-2021-38159
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/moveit-transfer-cve/"
published_at: "2022-04-05T05:01:12Z"
tags: ["cloud", "sql-injection", "vulnerability-analysis", "patch-diff", "moveit-transfer", "cve-2021-38159", "file-transfer"]
phying_url: "https://phying.com/item/7363"
lang: en
---

# CVE-2021-38159: MOVEit Transfer SQL Injection Analysis

## Summary

The author analyzes CVE-2021-38159, a SQL injection in MOVEit Transfer: after fighting trial-license limits, a DLL diff against the patched build pinpoints the unauthenticated injection point.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **CVE:** CVE-2021-38159
- **Published:** 2022-04-05T05:01:12Z
- **Original:** https://blog.viettelcybersecurity.com/moveit-transfer-cve/
- **Phying News:** https://phying.com/item/7363