Vulnerability · Published Jan 18, 2022 · Assigned by M-Files Corporation
CVE-2021-41807Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.
High 7.5
In plain English
A high-severity security flaw in M-Files Server from M-Files. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.1%top 34.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| M-Files | M-Files Server | Online – before 21.12.10873.02018 – before 21.12.10873.0 |
| M-Files | M-Files Web | Classic – before 21.12.10873.0vNext – before 21.12.10873.0 |
Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N