Vulnerability Details CVE-2021-37253
M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application
Exploit prediction scoring system (EPSS) score
EPSS Score 0.031
EPSS Ranking 86.1%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 7.8
References
- http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2021/Dec/1
- https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253
- https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/
- https://www.m-files.com/company/trust-center/vulnerability-disclosure/
- https://www.tenable.com/cve/CVE-2021-37253
- http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2021/Dec/1
- https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253
- https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/
- https://www.m-files.com/company/trust-center/vulnerability-disclosure/
- https://www.tenable.com/cve/CVE-2021-37253
Products affected by CVE-2021-37253
-
cpe:2.3:a:m-files:m-files_web:*