Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: M-Files Corporation Component: M-files Clear all filters
TI-2023-04134 CVE-2023-4479 · GHSA-r32c-fmcr-34r3

Cross-site scripting in M-Files Web

Priority LOW 32

Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document within limited time period.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00436 Published 2024-03-04 Fixed in 23.8.12892.6 CWE-79
TI-2023-02329 CVE-2023-2480 · GHSA-xgf2-5w76-r5jg

Elevation of Privilege in M-Files Desktop Client

Priority LOW 35

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.0018 Published 2023-05-25 Fixed in 23.5.12598.0, 23.2.12340.11 CWE-280
TI-2023-00206 CVE-2023-0213 · GHSA-f75p-j579-8r2c

Local Elevation of Privilege in M-Files

Priority LOW 39

Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00212 Published 2023-03-29 Fixed in 22.6 CWE-427
TI-2022-03904 CVE-2022-4264 · GHSA-j86w-j9vr-w3pm

Incorrect privilege assignment in M-Files Web Server

Priority LOW 30

Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0055 Published 2022-12-09 Fixed in 22.8.11691.0 CWE-269