Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2021-41807

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
M-Files Corporation

Description

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

M-Files M-Files Server

Default version status: unaffected

  • Online to < 21.12.10873.0affected
  • 2018 to < 21.12.10873.0affected

M-Files M-Files Web

Default version status: unaffected

  • Classic to < 21.12.10873.0affected
  • vNext to < 21.12.10873.0affected

References