CVE-2021-41810

Published: May 2, 2022Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable

Affected (1)

Products: M Files: Server

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
M Files Server	Before 22.2.11051.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://empower.m-files.com/security-advisories/CVE-2021-41810

Source: security@m-files.com

https://product.m-files.com/security-advisories/cve-2021-41810/

Source: security@m-files.com

https://www.m-files.com/about/trust-center/security-advisories/cve-2021-41810/

Source: security@m-files.com

Vendor Advisory

https://www.m-files.com/about/trust-center/security-advisories/cve-2021-41810/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.