Vulnerability · Published Dec 5, 2021 · Assigned by mitre

CVE-2021-37253

High 7.5

In plain English

A high-severity security flaw in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.9%top 12.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.m-files.com/company/trust-center/vulnerability-disclosure/ x_refsource_MISC
20211203 CVE-2021-37253: M-Files Web Improper Range Header Processing Denial of Services (DoS) Vulnerability mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html x_refsource_MISC
https://www.tenable.com/cve/CVE-2021-37253 x_refsource_MISC
https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 x_refsource_MISC
https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/ x_refsource_MISC