Vulnerability Description
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| M-Files | M-Files Web | < 20.10.9445.0 |
References
- https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-372Vendor Advisory
- https://www.m-files.com/company/trust-center/vulnerability-disclosure/Vendor Advisory
- https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-372Vendor Advisory
- https://www.m-files.com/company/trust-center/vulnerability-disclosure/Vendor Advisory
FAQ
What is CVE-2021-37254?
CVE-2021-37254 is a vulnerability with a CVSS score of 7.5 (HIGH). In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server.
How severe is CVE-2021-37254?
CVE-2021-37254 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-37254?
Check the references section above for vendor advisories and patch information. Affected products include: M-Files M-Files Web.