CVE-2021-37253

M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application

CVSS v3 7.5 HIGH
CVSS v2.0 7.8 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2021/Dec/1	Exploit Mailing List Third Party Advisory
https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253	Exploit Third Party Advisory
https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/	Vendor Advisory
https://www.m-files.com/company/trust-center/vulnerability-disclosure/	Vendor Advisory
https://www.tenable.com/cve/CVE-2021-37253	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:m-files:m-files_web:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-12-05 21:15

Updated : 2024-06-11 16:15

NVD link : CVE-2021-37253

Mitre link : CVE-2021-37253

CVE.ORG link : CVE-2021-37253

JSON object : View

Products Affected

m-files

m-files_web

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2021-37253", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-12-05T21:15:07.753", "references": [{"url": "http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2021/Dec/1", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.m-files.com/company/trust-center/vulnerability-disclosure/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.tenable.com/cve/CVE-2021-37253", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application"}, {"lang": "es", "value": "** EN DISPUTA ** M-Files Web antes de la versi\u00f3n 20.10.9524.1 permite una denegaci\u00f3n de servicio a trav\u00e9s de rangos superpuestos (en peticiones HTTP con cabeceras Range o Request-Range manipuladas). NOTA: esto se cuestiona porque el comportamiento de los rangos es responsabilidad del servidor web, no de la aplicaci\u00f3n web individual"}], "lastModified": "2024-06-11T16:15:15.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:m-files:m-files_web:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B5746C9-9A5D-43A4-BB4A-63A9AC35B503", "versionEndExcluding": "20.10.9524.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}