CVE-2021-44147

low-risk

Published 2021-11-22

An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks.

Do I need to act?

0.30% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (2)

Filemaker Pro

Filemaker Server

Affected Vendors

Claris

References (4)

Exploit https://davidhamann.de/2021/11/18/filemaker-xxe-vulnerability/

Vendor Advisory https://support.claris.com/s/answerview?anum=000035751

Exploit https://davidhamann.de/2021/11/18/filemaker-xxe-vulnerability/

Vendor Advisory https://support.claris.com/s/answerview?anum=000035751

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 7/34 · Low