CVE-2021-41808 - Vulnerability Details - OpenCVE

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
M-files	M-files Server

Configuration 1 [-]

cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/

History

No history.

MITRE

Status: PUBLISHED

Assigner: M-Files Corporation

Published: 2022-01-18T16:51:52.431113Z

Updated: 2024-09-17T02:51:33.573Z

Reserved: 2021-09-29T00:00:00

Link: CVE-2021-41808

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-01-18T17:15:08.953

Modified: 2024-11-21T06:26:48.087

Link: CVE-2021-41808

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "M-Files Server", "vendor": "M-Files", "versions": [{"lessThan": "21.11.10775.0", "status": "affected", "version": "Online", "versionType": "custom"}, {"lessThan": "21.11.10775.0", "status": "affected", "version": "2018", "versionType": "custom"}]}], "datePublic": "2022-01-18T00:00:00", "descriptions": [{"lang": "en", "value": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Information Exposure Through Log Files", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-01-18T16:51:52", "orgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "shortName": "M-Files Corporation"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}], "solutions": [{"lang": "en", "value": "Upgrade to M-Files version 21.11.10775.0 or newer."}], "source": {"discovery": "INTERNAL"}, "title": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs.", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@m-files.com", "DATE_PUBLIC": "2022-01-18T08:10:00.000Z", "ID": "CVE-2021-41808", "STATE": "PUBLIC", "TITLE": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "M-Files Server", "version": {"version_data": [{"version_affected": "<", "version_name": "Online", "version_value": "21.11.10775.0"}, {"version_affected": "<", "version_name": "2018", "version_value": "21.11.10775.0"}]}}]}, "vendor_name": "M-Files"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-532 Information Exposure Through Log Files"}]}]}, "references": {"reference_data": [{"name": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/", "refsource": "MISC", "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}]}, "solution": [{"lang": "en", "value": "Upgrade to M-Files version 21.11.10775.0 or newer."}], "source": {"discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:22:24.302Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}]}]}, "cveMetadata": {"assignerOrgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "assignerShortName": "M-Files Corporation", "cveId": "CVE-2021-41808", "datePublished": "2022-01-18T16:51:52.431113Z", "dateReserved": "2021-09-29T00:00:00", "dateUpdated": "2024-09-17T02:51:33.573Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BDD66C5-B192-426E-9974-046616F1BD15", "versionEndExcluding": "21.11.10775.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default."}, {"lang": "es", "value": "En el producto M-Files Server con versiones anteriores a 21.11.10775.0, al habilitar el registro de la autenticaci\u00f3n federada en el registro de eventos escrib\u00eda informaci\u00f3n confidencial en el registro. Los factores atenuantes son que el registro est\u00e1 deshabilitado por fallo"}], "id": "CVE-2021-41808", "lastModified": "2024-11-21T06:26:48.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 1.4, "source": "security@m-files.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-01-18T17:15:08.953", "references": [{"source": "security@m-files.com", "tags": ["Vendor Advisory"], "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}], "sourceIdentifier": "security@m-files.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security@m-files.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-532"}], "source": "nvd@nist.gov", "type": "Primary"}]}