CVE-2021-41810CWE-79

Script injection in M-Files Admin

Medium · published May 2, 2022

CVSS v3.1
5.2
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00713 · 53.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-05-02T19:06Z
EPSS history
Timeline
  • 02 MAY 19:06Z
    Script injection in M-Files Admin
    cvelistv5