CVE-2023-3425: Out-of-Bounds memory read
Priority LOW 36CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0066 51st percentileScored 2026-11-07
Fix Fixed M-Files Server (M-Files): 23.8.12892.6, 23.2.12340.14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| M-Files Corporation | M-Files Server | before 23.8.12892.6 | 23.8.12892.6, 23.2.12340.14 | Patch available | CNA |
- M-Files Server VendorM-Files Corporation Affected before 23.8.12892.6 Fixed in 23.8.12892.6, 23.2.12340.14 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:m-files:classic_web:*:*:*:*:lts:*:*:* | before 23.2 | Vulnerable | M-Files Corporation |
| cpe:2.3:a:m-files:classic_web:*:*:*:*:-:*:*:* | before 23.6.12695.3 | Vulnerable | M-Files Corporation |
| cpe:2.3:a:m-files:classic_web:23.2:-:*:*:lts:*:*:* | 23.2 | Vulnerable | M-Files Corporation |
- cpe:2.3:a:m-files:classic_web:*:*:*:*:lts:*:*:* Versions before 23.2 Vulnerable ·M-Files Corporation
- cpe:2.3:a:m-files:classic_web:*:*:*:*:-:*:*:* Versions before 23.6.12695.3 Vulnerable ·M-Files Corporation
- cpe:2.3:a:m-files:classic_web:23.2:-:*:*:lts:*:*:* Versions 23.2 Vulnerable ·M-Files Corporation
Remediation
- Fix · CNA M-Files Server (M-Files) Fixed in 23.8.12892.6, 23.2.12340.14
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3425
- 2026-10-03 Alias added: GHSA-fx24-f32v-56xf
- 2026-10-07 EPSS moved to the 50th–90th percentile
References
More M-Files Corporation Classic Web vulnerabilities
- TI-2023-03184 Path traversal issue in M-Files Classic Web CVSS 3.1HIGH 7.7
- TI-2023-02181 Cross-site scripting in M-Files Web CVSS 3.1HIGH 7.3
Sources
- CVE-2023-3425 · CVE Program
- CVE-2023-3425 · NVD
- FIRST EPSS
- GHSA-fx24-f32v-56xf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences