Vulnerability · Published May 2, 2022 · Assigned by M-Files Corporation
CVE-2021-41810Script injection in M-Files Admin
Medium 5.2
In plain English
A medium-severity cross-site scripting in M-Files Server from M-Files Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)5.2Medium
Exploit odds (30 days)0.7%top 46.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| M-Files Corporation | M-Files Server | M-Files Server – before 22.2.11051.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N