M-Files CorporationCVELIST:CVE-2021-41810CVE-2021-41810 Script injection in M-Files Server products with versions before 22.2.11051.0, allows executing stored script in admin tool
5.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
5.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
22.9%
Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable
CNA Affected
[
{
"product": "M-Files Server",
"vendor": "M-Files Corporation",
"versions": [
{
"lessThan": "22.2.11051.0",
"status": "affected",
"version": "M-Files Server",
"versionType": "custom"
}
]
}
]Related
5.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
5.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
22.9%