CVE-2021-37253

M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application

• CWE-444

• http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Dec/1Exploit, Mailing List, Third Party Advisory
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253Exploit, Third Party Advisory
• https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/Vendor Advisory
• https://www.m-files.com/company/trust-center/vulnerability-disclosure/Vendor Advisory
• https://www.tenable.com/cve/CVE-2021-37253Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Dec/1Exploit, Mailing List, Third Party Advisory
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253Exploit, Third Party Advisory
• https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/Vendor Advisory
• https://www.m-files.com/company/trust-center/vulnerability-disclosure/Vendor Advisory
• https://www.tenable.com/cve/CVE-2021-37253Exploit, Third Party Advisory

Published

Dec 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3723A command injection vulnerability was reported in the Integr…8.8
• CVE-2021-37231A stack-buffer-overflow occurs in Atomicparsley 20210124.204…5.5
• CVE-2021-37232A stack overflow vulnerability occurs in Atomicparsley 20210…9.8
• CVE-2021-37234Incorrect Access Control vulnerability in Modern Honey Netwo…6.5
• CVE-2021-3724Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-3725Vulnerability in dirhistory plugin Description: the widgets …8.8
• CVE-2021-37254In M-Files Web product with versions before 20.10.9524.1 and…7.5
• CVE-2021-3726# Vulnerability in `title` function **Description**: the `ti…9.8
• CVE-2021-37262JFinal_cms 5.1.0 is vulnerable to regex injection that may l…7.5
• CVE-2021-37267Cross Site Scripting (XSS) vulnerability exists in all versi…6.1
• CVE-2021-3727# Vulnerability in `rand-quote` and `hitokoto` plugins **Des…9.8
• CVE-2021-37270There is an unauthorized access vulnerability in the CMS Ent…9.8