Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: M-Files Corporation Component: Classic Web Clear all filters
TI-2023-02181 CVE-2023-2325 · GHSA-566r-vx98-9rr7

Cross-site scripting in M-Files Web

Priority LOW 33

Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00509 Published 2023-10-20 Fixed in 23.10, 23.2 LTS SR4 +1 CWE-79
TI-2023-03184 CVE-2023-3406 · GHSA-g25q-jw4h-pppq

Path traversal issue in M-Files Classic Web

Priority LOW 35

Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00742 Published 2023-08-25 Fixed in 23.6.12695.3, 23.2.12340.14 CWE-22
TI-2023-03201 CVE-2023-3425 · GHSA-fx24-f32v-56xf

CVE-2023-3425: Out-of-Bounds memory read

Priority LOW 36

Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0066 Published 2023-08-25 Fixed in 23.8.12892.6, 23.2.12340.14 CWE-125