CVE-2021-41808 - Vulnerability Details - OpenCVE

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:L/AC:M/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
M-files	M-files Server

Configuration 1 [-]

cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://empower.m-files.com/security-advisories/CVE-2021-41808
https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/

History

Mon, 23 Feb 2026 08:15:00 +0000

Type	Values Removed	Values Added
References		https://empower.m-files.com/security-advisories/CVE-2021-41808

MITRE

Status: PUBLISHED

Assigner: M-Files Corporation

Published: 2022-01-18T16:51:52.431Z

Updated: 2026-02-23T07:48:09.932Z

Reserved: 2021-09-29T00:00:00.000Z

Link: CVE-2021-41808

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-01-18T17:15:08.953

Modified: 2026-02-23T08:16:11.823

Link: CVE-2021-41808

Redhat

No data.

{"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "M-Files Server", "vendor": "M-Files", "versions": [{"lessThan": "21.11.10775.0", "status": "affected", "version": "Online", "versionType": "custom"}, {"lessThan": "21.11.10775.0", "status": "affected", "version": "2018", "versionType": "custom"}]}], "datePublic": "2022-01-17T22:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.</p>"}], "value": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Information Exposure Through Log Files", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "shortName": "M-Files Corporation", "dateUpdated": "2026-02-23T07:48:09.932Z"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}, {"tags": ["vendor-advisory"], "url": "https://empower.m-files.com/security-advisories/CVE-2021-41808"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Upgrade to M-Files version 21.11.10775.0 or newer.</p>"}], "value": "Upgrade to M-Files version 21.11.10775.0 or newer."}], "source": {"discovery": "INTERNAL"}, "title": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs.", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "DATE_PUBLIC": "2022-01-18T08:10:00.000Z", "ID": "CVE-2021-41808", "STATE": "PUBLIC", "TITLE": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "M-Files Server", "version": {"version_data": [{"version_affected": "<", "version_name": "Online", "version_value": "21.11.10775.0"}, {"version_affected": "<", "version_name": "2018", "version_value": "21.11.10775.0"}]}}]}, "vendor_name": "M-Files"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-532 Information Exposure Through Log Files"}]}]}, "references": {"reference_data": [{"name": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/", "refsource": "MISC", "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}]}, "solution": [{"lang": "en", "value": "Upgrade to M-Files version 21.11.10775.0 or newer."}], "source": {"discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:22:24.302Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}]}]}, "cveMetadata": {"assignerOrgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "assignerShortName": "M-Files Corporation", "cveId": "CVE-2021-41808", "datePublished": "2022-01-18T16:51:52.431Z", "dateReserved": "2021-09-29T00:00:00.000Z", "dateUpdated": "2026-02-23T07:48:09.932Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BDD66C5-B192-426E-9974-046616F1BD15", "versionEndExcluding": "21.11.10775.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default."}, {"lang": "es", "value": "En el producto M-Files Server con versiones anteriores a 21.11.10775.0, al habilitar el registro de la autenticaci\u00f3n federada en el registro de eventos escrib\u00eda informaci\u00f3n confidencial en el registro. Los factores atenuantes son que el registro est\u00e1 deshabilitado por fallo"}], "id": "CVE-2021-41808", "lastModified": "2026-02-23T08:16:11.823", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 1.4, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-01-18T17:15:08.953", "references": [{"source": "[email protected]", "url": "https://empower.m-files.com/security-advisories/CVE-2021-41808"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-532"}], "source": "[email protected]", "type": "Primary"}]}