PT-2021-21591 · M Files · M-Files Web

Murat Aydemir · Published 2021-12-03 · Updated 2024-08-04 · CVE-2021-37253

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions M-Files Web versions prior to 20.10.9524.1

Description The issue allows a denial of service via overlapping ranges in HTTP requests with crafted Range or Request-Range headers. It is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application.

Recommendations For versions prior to 20.10.9524.1, update to version 20.10.9524.1 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted HTTP requests with overlapping ranges in the Range or Request-Range headers until a patch is available.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-37253

Affected Products

M-Files Web

References · 15

• 🔥 http://seclists.org/fulldisclosure/2021/Dec/1 · Exploit
• 🔥 http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html · Exploit
• 🔥 https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 · Exploit
• 🔥 https://tenable.com/cve/CVE-2021-37253 · Exploit
• https://m-files.com/company/trust-center/vulnerability-disclosure · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37253 · Security Note
• https://m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37253 · Vendor Advisory
• https://t.me/cvenotify/24452 · Telegram Post
• https://t.me/defcon_news/91210 · Telegram Post
• https://t.me/cvenotify/25573 · Telegram Post
• https://t.me/cvenotify/82817 · Telegram Post
• https://t.me/cvenotify/24244 · Telegram Post
• https://t.me/cibsecurity/33349 · Telegram Post
• https://t.me/cvenotify/88886 · Telegram Post