Medium severity · published May 2, 2022
CVE-2021-41810
Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Server · M-files
before 22.2.11051.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41810
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41810
empower.m-files.com
https://empower.m-files.com/security-advisories/CVE-2021-41810
product.m-files.com
https://product.m-files.com/security-advisories/cve-2021-41810/
Vendor Advisory
https://www.m-files.com/about/trust-center/security-advisories/cve-2021-41810/