Paper/Archive/CVE-2021-41807

CVE-2021-41807

M-Files M-Files Server — Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 65.8.658 × 2013.2 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.

Affected

ProductAffectedFixed inSource

M-Files ServerOnline – < 21.12.10873.021.12.10873.0CNA

M-Files Server2018 – < 21.12.10873.021.12.10873.0CNA

M-Files WebClassic – < 21.12.10873.021.12.10873.0CNA

M-Files WebvNext – < 21.12.10873.021.12.10873.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

M-Files Corporation (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

refm-files.com/about/trust-center/security-vulnerabilities/cve-2021-41807 advisoryempower.m-files.com/security-advisories/CVE-2021-41807