Low severity · published Jan 18, 2022
CVE-2021-41808
In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log
2.3
CVSS
0.2%
EPSS
No
On KEV
Description
In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
M-files Server · M-files
before 21.11.10775.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41808
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41808
empower.m-files.com
https://empower.m-files.com/security-advisories/CVE-2021-41808
Vendor Advisory
https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/
More from M-files Server
9.8
CVE-2024-10127
Support for authentication bypass condition in M-Files LDAP authentication
9.8
CVE-2023-6912
Brute force vulnerability in M-Files user authentication
9.8
CVE-2021-41807
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and…
8.8
CVE-2023-6239
Incorrect calculation of effective permissions
7.8
CVE-2023-2112
Desktop component allows lateral movement between sessions