CVE-2021-37254

Опубликовано: 28 окт. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server.

Ссылки

https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-37254/
Vendor Advisory
https://www.m-files.com/company/trust-center/vulnerability-disclosure/
Vendor Advisory
https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-37254/
Vendor Advisory
https://www.m-files.com/company/trust-center/vulnerability-disclosure/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:m-files:m-files_web:*:*:*:*:*:*:*:*

Версия до 20.10.9445.0 (исключая)

cpe:2.3:a:m-files:m-files_web:*:*:*:*:*:*:*:*

Версия от 20.10.9500.0 (включая) до 20.10.9534.1 (исключая)

EPSS

Процентиль: 55%

0.00321

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-gjv4-q69q-pgqc