Description (CNA)
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| M-Files / M-Files Server | affected Online before 21.12.10873.0; affected 2018 before 21.12.10873.0 |
| M-Files / M-Files Web | affected Classic before 21.12.10873.0; affected vNext before 21.12.10873.0 |
CWE
CWE-307
References
- https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41807/
- https://empower.m-files.com/security-advisories/CVE-2021-41807
ADP enrichment
No English description supplied.