CVE-2021-41807 Security feature bypass in M-Files Server
Attackers can brute-force user accounts due to missing rate limiting in M-Files Server and Web products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41807?
CVE-2021-41807 is a high-severity vulnerability in M-Files Server, published on 18 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.
Weakness: CWE-307
Which versions are affected by CVE-2021-41807?
It affects 2 products.
Products include M-Files M-Files Server, M-Files M-Files Web.
How do I fix CVE-2021-41807?
No fix has been published for CVE-2021-41807 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-41807 being exploited?
There is no known exploitation of CVE-2021-41807 in the wild and no public exploit code.
Other vulnerabilities in M-Files Server
- CVE-2024-10127 Support for authentication bypass condition in M-Files LDAP authentication
- CVE-2025-5964 Path traversal in M-Files API
- CVE-2024-6789 Path traversal in M-Files API
- CVE-2024-4056 Denial of service condition in M-Files Server
- CVE-2023-6912 Brute force vulnerability in M-Files user authentication
Sources
Also known as GHSA-5c8j-7c6c-838x.