CVE-2021-37253

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-37253
M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2021/Dec/1 Exploit Mailing List Third Party Advisory
https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 Exploit Third Party Advisory
https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/ Vendor Advisory
https://www.m-files.com/company/trust-center/vulnerability-disclosure/ Vendor Advisory
https://www.tenable.com/cve/CVE-2021-37253 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:m-files:m-files_web:*:*:*:*:*:*:*:*
History

07 Nov 2023, 03:36

Type Values Removed Values Added
Summary ** DISPUTED ** M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application. M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application

31 Mar 2022, 16:30

Type Values Removed Values Added
References (MISC) https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/ - (MISC) https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/ - Vendor Advisory

18 Jan 2022, 14:15

Type Values Removed Values Added
References
  • (MISC) https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/ -

16 Dec 2021, 20:34

Type Values Removed Values Added
References (MISC) https://www.tenable.com/cve/CVE-2021-37253 - (MISC) https://www.tenable.com/cve/CVE-2021-37253 - Exploit, Third Party Advisory
References (MISC) https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 - (MISC) https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 - Exploit, Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2021/Dec/1 - (FULLDISC) http://seclists.org/fulldisclosure/2021/Dec/1 - Exploit, Mailing List, Third Party Advisory

09 Dec 2021, 13:15

Type Values Removed Values Added
Summary M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). ** DISPUTED ** M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application.

09 Dec 2021, 10:15

Type Values Removed Values Added
References
  • (MISC) https://www.tenable.com/cve/CVE-2021-37253 -
  • (MISC) https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 -
  • (FULLDISC) http://seclists.org/fulldisclosure/2021/Dec/1 -

07 Dec 2021, 13:23

Type Values Removed Values Added
CPE cpe:2.3:a:m-files:m-files_web:*:*:*:*:*:*:*:*
CWE CWE-444
CVSS v2 : unknown
v3 : unknown 		v2 : 7.8
v3 : 7.5
References (MISC) https://www.m-files.com/company/trust-center/vulnerability-disclosure/ - (MISC) https://www.m-files.com/company/trust-center/vulnerability-disclosure/ - Vendor Advisory
References (MISC) http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html - (MISC) http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html - Exploit, Third Party Advisory, VDB Entry

05 Dec 2021, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-05 21:15

Updated : 2024-04-11 01:12

NVD link : CVE-2021-37253

Mitre link : CVE-2021-37253

CVE.ORG link : CVE-2021-37253

JSON object : View

Products Affected

m-files

  • m-files_web
CWE
CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')