CVE-2021-41807

HIGH

M-Files Server and Web < 21.12.10873.0 - Unauthenticated Brute-Force Attack via Missing Rate Limiting

Title source: llm

Description

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.

References (2)

Core 2

Core References

Broken Link, Vendor Advisory x_refsource_misc

https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41807/

Various Sources vendor-advisory

https://empower.m-files.com/security-advisories/CVE-2021-41807

Scores

CVSS v3 7.5

EPSS 0.0111

EPSS Percentile 61.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-307

Status published

Products (2)

m-files/m-files_server < 21.12.10873.0

m-files/m-files_web < 21.12.10873.0

Published Jan 18, 2022

Tracked Since Feb 18, 2026