IN THIS PAGE
v2021.1.8 (13.1.8)
What's New in MOVEit Transfer
Release |
Version |
Date |
Description |
2021.0 |
13.1 |
Oct 01, 2021 |
Initial release |
2021.1.1 |
13.1.1 |
Oct, 2021 |
Quality hotfix |
2021.1.3 |
13.1.3 |
July, 2021 |
Security hotfix |
2021.1.4 |
13.1.4 |
May 31, 2023 |
Security hotfix. For details, see Fixed Issues in 2021.1.5. |
2021.1.5 |
13.1.5 |
June 9, 2023 |
|
2021.1.6 |
13.1.6 |
June 15, 2023 |
Security hotfix. For details, see Fixed Issues in 2021.1.6. |
2021.1.7 |
13.1.7 |
July 5, 2023 |
Service Pack. For details, see Fixed Issues in 2021.1.7. |
2021.1.8 |
13.1.8 |
September 2023 |
Service Pack. For details, see Fixed Issues in 2021.1.8. |
Accessibility Improvements
To expand usability of MOVEit Transfer for all users, we improved our user interface to help conform with WCAG 2.1 AA accessibility guidelines. These improvements include keyboard navigability for WebUI pages to accommodate keyboard-only users, screen reader support, and compliance with minimum contrast standards.
MySQL Database Engine Conversion
When you install or upgrade a MOVEit Transfer system using the bundled MySQL Database, MOVEit Transfer installs the standard InnoDB storage engine for greater reliability and scale. Data migration to the new InnoDB scheme is automatic.
When you upgrade to MOVEit Transfer 2021.1 with the bundled MySQL Server, your database tables will be automatically upgraded to InnoDB. To successfully upgrade you must have free disk space on the database drive equal to at least three times the size of the current MOVEit Transfer database.
RESTful API Improvements
MOVEit Transfer 2021.1 adds new capabilities to its REST API.
For detailed information, see the MOVEit Transfer RESTful API reference guide.
REST API Feature |
Syntax/Description/Example |
Update User Password. New update capability to
|
Request body example:
|
Package Requirements Properties. (Updated for 2021.1.1) We extended the This work extends current use cases and reveals values for download limits set by (or on behalf of) the current user. (If not set by sender, org limits apply.)
Also added, attachment permission toggle values for the current user (sender).
|
Return object example:
|
Easier to Deregister Token from External App. (Updated for 2021.1.1) A new DELETE verb allows simple deregistration for external application tokens. |
Request body example:
|
Fixed Issues
This section outlines issues tracked and fixed by the MOVEit product team for the 2021.1.x release. Not all changes suggested by customers or uncovered in usability testing are tracked as issues or defects. See the What's New section for a broader view of these improvements.
ID |
Category |
Fixed Issue |
47961 |
WebUI |
Enhanced data handling scoping operations based on periodic security testing. |
47962 |
WebUI |
Enhanced data handling scoping operations based on periodic security testing. |
47737 |
WebUI |
Fixed upload Window language behavior. |
35796 |
Account Creation |
Fixed issue so switching org auth to external will follow org policy for password setup. |
48283 |
Config Utility |
Fixed issue that limited MySQL password length. |
47845 |
WebUI (Admin) |
Fixed paging issue for expiration policies page. |
47086 |
WebUI (GroupAdmin) |
Fixed exception handling for Folder Settings page. |
46944 |
WebUI |
Fixed Custom Report run report output format behavior. |
47064 |
Installer |
Fixed issue where detecting a non-default logs directory caused issue for upgrade scenario. |
47438 |
Scheduled Tasks |
Fixed a write-to log issue for syncLDAP process. |
47304 |
WebUI |
Refactored license count warning to ignore TempUser count. |
7201 |
WebUI |
Fixed issue where end-user could not access default home in WebUI when AdHoc functionality switched off. |
5980 |
Remote Filestore |
Refined condition for UNC mount failure scenario. |
5694 |
WebUI |
Virtual folders present option to upload to subfolders without permission. |
47830 |
Installer (upgrade) |
Fixed exception handling of TimeEnded value for Taskruns table. |
43190 |
User Settings |
Fixed recipient limit for Temp users. |
32559 |
Mulesoft Connector |
Fixed timeout for large files. |
31756 |
Notifications |
Refined file notification behavior to include copied files. |
12430 |
Uploader |
Fixed "no attachment" pop-up warning for Ad Hoc packages. |
36286 |
WebUI |
Admins can't share folder with email address only when AdHoc enabled. |
36135 |
Uploader |
Fixed out-of-memory error for large file uploads. |
8660/11847 |
Transfer Server |
Implemented best practices for Content-Security-Policy. |
47195 |
Large File Stores |
Fixed incorrect reports of missing files. |
47063 |
Logging |
Fixed exception handling for flush to file operation. |
50552 |
REST API |
Fixed out-of-memory exception that could happen using resumable upload and AV/DLP scanners are configured. |
50312 |
SAML |
Fixed issue resulting in URI destination mismatch for case where federated identity provider requires the URI to include a port value even when it is the well-known default. |
47818 |
WebUI |
Fixed issue where certain collapsible controls were not accessible using keyboard navigation. |
42830 |
WebUI |
Fixed issue where a group user list displayed to a GroupAdmin could be incomplete. |
48496 |
Installer/MySQL |
Updated MySQL server distribution to latest recommended version. |
36330 |
Documentation |
Added name=transaction attribute value to example syntax in Single Sign-on Integration section of the Admin Guide. |
36125 |
WebUI |
Limited GroupAdmin password policy to members of their group (not including the GroupAdmin user). |
47844 |
Security |
Fixed vulnerability based on NIST CVE-2020-27511R |
47955 |
Uploader |
Fixed/improved the response delay observed when canceling an upload. |
Fixed Issues in 2021.1.1
This section outlines issues tracked and fixed by the MOVEit product team for the 2021.1.2 maintenance release.
ID |
Category |
Fixed Issue |
51945 |
MySQL Bundle |
The current installer upgrades the current MySQL database (if used) to 8.0.27. This version includes a critical patch for MySQL. For details, refer to Oracle's documentation (https://www.oracle.com/security-alerts/cpuoct2021.html#AppendixMSQL). |
51597 |
Installer |
Added library updates to protect passwords during install. |
Fixed Issues in 2021.1.3
This section outlines issues tracked and fixed by the MOVEit product team for the 2021.1.3 maintenance release.
ID |
Category |
Fixed Issue |
66086 |
API-REST/Security |
REST API unhandled exception. |
Fixed Issues in 2021.1.4
This section outlines issues tracked and fixed by the MOVEit product team for the 2021.1.4 hotfix release.
ID |
Category |
Fixed Issue |
69698 |
Server/WebUI |
Hotfix/patch for CVE-2023-34362: Addressed a SQL injection vulnerability that may allow an attacker to gain unauthorized access to MOVEit Transfer's database. https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability |
Fixed Issues in 2021.1.5
This section outlines issues tracked and fixed by the MOVEit product team for the 2021.1.5 hotfix release.
ID |
Category |
Fixed Issue |
69884 |
Server/WebUI |
Hotfix/patch for CVE-2023-35036: Addressed a SQL injection vulnerability that may allow an attacker to gain unauthorized access to MOVEit Transfer's database. https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability |
Fixed Issues in 2021.1.6
This section outlines issues tracked and fixed by the MOVEit product team for the 2021.1.6 hotfix release.
ID |
Category |
Fixed Issue |
70125 |
Server |
Hotfix/patch for CVE-2023-35708: Addressed a SQL injection vulnerability that may allow an attacker to gain unauthorized access to MOVEit Transfer's database. https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15Jun2023 |
Fixed Issues in 2021.1.7
This section outlines issues tracked and fixed by the MOVEit product team for the 2021.1.7 service pack (July 5, 2023).
ID |
Category |
Fixed Issue |
68501 | Installer | Installer upgrades and repair mode slow if certificate storage has large number of certs. |
69752 | Server/Security | Improved controls and validation for active sessions. |
69753 | Server/Security | Improved controls and validation for upload states. |
69990 | Server/REST API | Improved availability issue that could occur with increased volume and scale out of session sign-on activity. |
69998 | Server | Improved transaction server parsing. |
70001 | Server/Security | Newer password hashing scheme enforced. Legacy scheme is no longer supported. |
70167 | Server | Refactoring and abstraction of OrgEngine/InstCertAdd. |
70176 | Server/Security | Addressed a SQL injection vulnerability that may allow an authorized user to gain unauthorized access to MOVEit Transfer's database. |
70312 | Server/Security | Addressed a SQL injection vulnerability that may allow an authorized user to gain unauthorized access to MOVEit Transfer's database. |
70404 | Server/User Auth | Addressed a SQL injection vulnerability that may allow an attacker to gain unauthorized access to MOVEit Transfer's database. |
Fixed Issues in 2021.1.8
This section outlines issues tracked and fixed by the MOVEit product team for the 2021.1.8 service pack (September 2023).
ID |
Category |
Fixed Issue |
70103 | Security/SSH | Improved handling of long usernames when writing log entries. |
70252 | Security/Server | Applied best practice for loading libraries. |
71353 | Server/Utilities | Sysadmin password reset utility not supported. |
70732 | Server | Handle transactions to block unwanted queries. |
70780 | Security/Webapp | Adjustments to align with best practices when viewing dynamic scan results. |
71019 | Performance/Security | Improvements to upload size using WebUI. |
71109 | Database/Security | SQL injection possible for authorized sysadmin user. |
71263 | Database/Security | Authenticated SQL injection possible through machine interface. |
71319 | WebUI/Security | Added user-permissions checks and handling for multi-org deployments that use the WebUI. |
71325 | LDAP/Security/WebUI | Improvements to handle multi-org permission scope with deployments using LDAP or RADIUS. |
71587 | Server/Authentication | Additional session hardening. |
72231 | Security/UI | Fixed medium vulnerability found in Ad Hoc UI functionality. |
Upgrading
Upgrading to the latest version of MOVEit Transfer ensures that you have access to the latest features, fixes, security updates, and usability improvements.
If you have a support subscription, upgrades are free. For licensing information, you can read this MOVEit License FAQ.
Get the Installer and Activation Code
To get a MOVEit installer package:
- Log in to the Progress Customer and Community portal and select Product Downloads.
- Download the product package.
When you get your MOVEit product package from your Progress Community page, the activation code is embedded in the download file and is automatically applied during installation.
The activation code is also stored in your Progress Community product page for reference.
- Before you run the upgrade installer.
- Review Upgrade Guidelines. They identify useful tips and guidelines for existing MOVEit Transfer or MOVEit DMZ users.
- It is a good idea to copy and save your current product serial number. This Progress knowledge base article explains how to find it.
Upgrade Paths
MOVEit Transfer 2021 supports "direct upgrade" (upgrade by way of running the MOVEit Transfer installer) for existing MOVEit Transfer 2019 (11.0.0) and newer.
Use the Upgrade Path table to find out how you can move earlier or legacy versions to MOVEit Transfer 2021.
Your Older MOVEit Transfer Version |
Upgrade Path |
MOVEit Transfer 2019 (11.0.0) or newer |
Use Upgrade mode in MOVEit installer:
|
MOVEit Transfer 2018 PLUS SP2 (10.2) and older |
If you are running a version that is out of date or close to being out of date, you can:
|
Upgrade Considerations
Logs Directory for Web Farm Upgrade
When you upgrade a MOVEit Transfer Server node, ensure that the local logs directory defined in the Web Farm install configuration for all nodes already exists (or create one on each node). If the installer does not find this local logs directory, it will return a failure message and halt during the Web Farm scale-out process.
MySQL Database Deployments
When you run the MOVEit Transfer installer in an upgrade scenario on a MOVEit Transfer deployment using MySQL, the installer upgrades existing MySQL 5.7 servers to MySQL 8.x.
Any custom schema, tables, and fields (if applicable) must be backed up
It is best practice to backup any customizations before you run the MOVEit Transfer installer. MOVEit Transfer database schema customizations are not supported. If you change the name or add schema, indexes, or tables, the MOVEit Installer will not expect these manual changes and attempt to revert them.
Reset tamper check for logs
If you have logs that include data from before and after a software upgrade, tamper check verification shows false positive tamper errors when verifying the logs.
To prevent this situation, do the following when upgrading MOVEit DMZ software to MOVEit Transfer 2017 (and later).
- Before you upgrade, manually start the MOVEit DMZ Log Tamper Check program from the Start menu.
- Immediately after you upgrade:
- Sign-on as System Administrator. Click SETTINGS.
- In the System section, Tamper Detection row, click Reset All Orgs.
- Click Reset Tamper Detection Data.
Upgrading to a release with Secure Folder Sharing (a post upgrade task is necessary)
If you upgrade your MOVEit Transfer installation with a version that enables Secure Folder Sharing, this feature set will be initially set to off. After the upgrade, as sysadmin user, you can apply the Secure Folder Sharing feature set selectively in Org Profile Settings. As sysadmin, you can apply these settings on an org-by-org basis.
System Requirements
MOVEit Transfer requires certain software and hardware to ensure correct operation.
MOVEit Transfer Server Requirements
These requirements apply to the supporting environment and operating system where you install MOVEit Transfer server.
Before you attempt to install MOVEit Transfer server, ensure your Windows server has the latest service packs and required updates installed.
Hardware Requirements
Minimum server requirements
- Four-core server-class CPU (For example: Intel Xeon 4-core 2+GHz)
- 8 GB RAM
- 250 GB or larger free disk space, depending on workload
- Gigabit Ethernet (GigE) Interface.
Typical server requirements
- Eight-core CPU.
- 16 GB RAM.
- Hard drive capacity of 1TB (SAS) is common.
- Free disk space should be sized based on the system log, task logs, and the expected number of concurrent active users and transfers.
- Using SSD or other high-performance disk will improve performance.
- GigE or better network interface card.
Note: MOVEit Transfer requires a dedicated server machine or hypervisor. Do not install MOVEit Transfer on a machine that has other applications installed.
Software Requirements
MOVEit Transfer server requires the following software.
Supported Operating Systems for MOVEit Transfer
- Windows Server 2019
- Windows Server 2016
.NET Framework
MOVEit Transfer requires .NET 4.7.2. If the server does not have Internet access, you must install .NET by other means before you run the MOVEit Transfer installation program.
Windows Server 2019 comes with .NET 4.7.2.
Supported Databases
MOVEit Transfer requires one of the following database platforms:.
- MySQL 8 (included in the MOVEit Transfer installation)
- Azure SQL Database
- Microsoft SQL Server 2019 Enterprise/Standard
- Microsoft SQL Server 2017 Enterprise/Standard
- Microsoft SQL Server 2016 Enterprise/Standard
- Earlier versions (not supported)
It is best to run the MOVEit Transfer Server and the database it connects to in the same time zone. Otherwise, security features like multi-factor authentication for sign-on as well as secure connection protocols used between the services will not function.
You can create an Azure SQL database using the Azure Management Portal. See the upgrade and migration section for instructions on how to migrate your current database to Azure SQL.
Compatible Third-Party AV/DLP Engines
The following major anti-virus (AV) and data loss prevention (DLP) engines are reviewed for compatibility with MOVEit Transfer.
AV Engines (some with AV/DLP)
Anti-Virus Scanner |
Latest Version Reviewed |
McAfee VirusScan Enterprise |
Last reviewed version 8.8.0.2300 |
McAfee VirusScan Enterprise for Storage (VSES) |
Last reviewed version 1.3 |
McAfee Endpoint Security |
Last reviewed version 10.7.0.1675 |
McAfee Web Gateway |
Last reviewed version 9.29 (36018) |
Sophos Anti-Virus Dynamic Interface (SAVDI) scanner |
Last reviewed version: 2.6 |
Sophos for Network Storage |
Last reviewed version: 10.8.10.810 |
Symantec Protection Engine |
Last reviewed version 7.8.0.141 |
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) * |
Last reviewed:
|
DLP Engines
Data Loss Prevention Scanner |
Latest Version Reviewed |
McAfee Web Gateway* |
Last reviewed with version 9.29 (36018) |
Symantec DLP Suite |
Last reviewed with version 15.x* |
*DLP Blocked responses require additional configuration for some scanning engines such as McAfee and Symantec.
TLS Certificate
For use in production environments of the MOVEit Transfer Server, you should install a certificate from a trusted certificate authority. Apply the trusted certificate during installation or through the configuration utility.
Email Server (for notifications)
MOVEit Transfer needs an SMTP server to relay package notifications, account notifications, and other user messages. You will be asked for an SMTP server and credentials during the install process.
If you do not have email server information at the time of install, you can use the MOVEit Transfer Configuration Utility to add this information. For more information, see the MOVEit Transfer Admin Guide.
Browser Support
Supported Web Browsers
- Chrome
- Mozilla Firefox
- Microsoft Edge
- Safari
Other browsers might work with MOVEit Transfer but are not officially supported.
Additional Clients
MOVEit Mobile
MOVEit Mobile is available for the following devices:
- iOS (Apple devices). Available for download in the Apple App Store.
- Android (Android OS devices). Available for download from Google Play.
MOVEit Client
All current versions of the MOVEit Client are supported. Older versions will work with limited feature capabilities. Download the latest versions from the MOVEit Products page.
Outlook Ad Hoc Add-in (person-to-person transfer)
MOVEit Add Hoc Add-in for Microsoft Outlook is available to users that use Microsoft Outlook as specified in the client requirements published by Microsoft.
Outlook Add-In
https://docs.microsoft.com/en-us/office/dev/add-ins/outlook/add-in-requirements
Outlook Client (Web)
https://docs.microsoft.com/en-us/office/dev/add-ins/outlook/add-in-requirement
Legacy Outlook Plug-in (Ad Hoc)
- Outlook Client:
Outlook 2016 (English, German, French, Japanese, Simplified Chinese, Spanish and Traditional Chinese)
Outlook 2013 (English, German, French, Japanese, Simplified Chinese, Spanish and Traditional Chinese)
Outlook 2010 (32-bit and 64-bit English, German, French, Japanese, Simplified Chinese, Spanish and Traditional Chinese)
- Mail or Exchange Server:
Ad Hoc Transfer Plug-in for Outlook is compatible with a variety of mail servers, such as Exchange Server 2013, Exchange Server 2010 (32-bit and 64-bit English and German), or Progress IMail 11 (using SMTP). When Outlook & Exchange are used together, Cached Exchange Mode is supported but is not required.
- Operating System:
Microsoft Windows 10, Microsoft Windows 8, Windows 7 (32-bit and 64-bit English, German, French, Chinese Simplified, Chinese Traditional, Japanese)
Known Issues
This section outlines known issues and typical workarounds for MOVEit Transfer.
ID |
Category |
Known Issue in MOVEit Transfer |
365955 |
Installer |
After you upgrade a MOVEit Transfer server to 2020 that leverages the legacy mobile server, if you subsequently uninstall only MOVEit Transfer, the next time you run the installer the Modify option displays but no real modify-install scenario exists. You will not be able to complete the MOVEit Transfer install process. Workaround: To run the installer successfully, you will need to uninstall the deprecated MOVEit Mobile Server manually. Then you can re-run the MOVEit Transfer Installer. |
31190 |
REST API |
Some virtual folder operations do not extend to the REST API. Workaround: For full parity, use the WebUI or MOVEit Automation. |
35331 |
Key Rotation |
If disk capacity is less than the largest file in your filestore and you run key rotation, your key rotation process will fail to convert that file. |
22448 |
Key Rotation |
Key rotation functionality does not extend directly to environments that use Azure Blob Service for their filestore. Workaround: Azure Storage has its own encryption scheme and key management infrastructure. |
51533 |
Outlook Add-In |
If Internet Explorer is configured with Enhanced Security Configuration (ESC) and you run MOVEit Add-in for Outlook (Ad Hoc), the add-in pane fails to load. For example, this issue might occur if you run MOVEit Add-in for Outlook (Ad Hoc) with older versions of Windows that still include Internet Explorer. (Note that Windows Server enables IE ESC by default.) Workaround: Run the MOVEit Add-in for Outlook (Ad Hoc) from a machine that does not bundle Internet Explorer, such as a non-server version, or add the resource needed by MOVEit Add-in for Outlook (Ad Hoc) to launch as a trusted site. You can also disable IE ESC. |
Licensees and Evaluators
For more information, please check our:
- Progress Software End-user License Agreement (EULA).
- Knowledge base article about MOVEit licensing.
Copyright Notice
© 2023 Progress Software Corporation and/or one of its subsidiaries or affiliates. All rights reserved.
These materials and all Progress® software products are copyrighted and all rights are reserved by Progress Software Corporation. The information in these materials is subject to change without notice, and Progress Software Corporation assumes no responsibility for any errors that may appear therein. The references in these materials to specific platforms supported are subject to change.
Chef, Chef (and design), Chef Infra, Code Can (and design), Compliance at Velocity, Corticon, DataDirect (and design), DataDirect Cloud, DataDirect Connect, DataDirect Connect64, DataDirect XML Converters, DataDirect XQuery, DataRPM, Defrag This, Deliver More Than Expected, DevReach (and design), Icenium, Inspec, Ipswitch, iMacros, Kendo UI, Kinvey, MessageWay, MOVEit, NativeChat, NativeScript, OpenEdge, Powered by Chef, Powered by Progress, Progress, Progress Software Developers Network, SequeLink, Sitefinity (and Design), Sitefinity, Sitefinity (and design), SpeedScript, Stylus Studio, Stylized Design (Arrow/3D Box logo), Styleized Design (C Chef logo), Stylized Design of Samurai, TeamPulse, Telerik, Telerik (and design), Test Studio, WebSpeed, WhatsConfigured, WhatsConnected, WhatsUp, and WS_FTP are registered trademarks of Progress Software Corporation or one of its affiliates or subsidiaries in the U.S. and/or other countries.
Analytics360, AppServer, BusinessEdge, Chef Automate, Chef Compliance, Chef Desktop, Chef Habitat, Chef WorkStation, Corticon.js, Corticon Rules, Data Access, DataDirect Autonomous REST Connector, DataDirect Spy, DevCraft, Fiddler, Fiddler Everywhere, FiddlerCap, FiddlerCore, FiddlerScript, Hybrid Data Pipeline, iMail, JustAssembly, JustDecompile, JustMock, KendoReact, NativeScript Sidekick, OpenAccess, PASOE, Pro2, ProDataSet, Progress Results, Progress Software, ProVision, PSE Pro, Push Jobs, SafeSpaceVR, Sitefinity Cloud, Sitefinity CMS, Sitefinity Digital Experience Cloud, Sitefinity Feather, Sitefinity Insight, Sitefinity Thunder, SmartBrowser, SmartComponent, SmartDataBrowser, SmartDataObjects, SmartDataView, SmartDialog, SmartFolder, SmartFrame, SmartObjects, SmartPanel, SmartQuery, SmartViewer, SmartWindow, Supermarket, SupportLink, Unite UX, and WebClient are trademarks or service marks of Progress Software Corporation and/or its subsidiaries or affiliates in the U.S. and other countries. Java is a registered trademark of Oracle and/or its affiliates. Any other marks contained herein may be trademarks of their respective owners.
This document was published on Monday, June 5, 2023 at 14:06
OCT
01
2021