Skip to main content

M Files CVE-2022-4861

MEDIUM
Incorrect Implementation of Authentication Algorithm (CWE-303)
2022-12-30 security@m-files.com
Information Disclosure M Files M Files Client
4.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 30, 2022 - 14:15 nvd
MEDIUM 4.9

DescriptionNVD

Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.

AnalysisAI

Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-303. Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource. Affected products include: M-Files M-Files Client. Version information: before 22.5.11356.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in M Files

View all
CVE-2021-37253 HIGH POC
7.5 Dec 05

M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range o
CVE-2023-6912 CRITICAL
9.8 Dec 20

Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authe
CVE-2024-10127 CRITICAL
9.2 Nov 20

Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLD
CVE-2023-6239 HIGH
8.8 Nov 28

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specif
CVE-2022-39016 HIGH
8.8 Oct 31

Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account
CVE-2024-6881 HIGH
8.5 Jul 29

Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript

CVE-2024-6124 HIGH
8.5 Jul 29

Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the

CVE-2024-6789 HIGH
8.4 Aug 27

A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 2
CVE-2023-5523 HIGH
7.8 Oct 20

Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versi
CVE-2023-2480 HIGH
7.8 May 25

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation

CVE-2023-2112 HIGH
7.8 Apr 20

Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. Rated high severity (
CVE-2023-0213 HIGH
7.8 Mar 29

Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges

Same weakness CWE-303 – Incorrect Implementation of Authentication Algorithm

View all
CVE-2023-29357 CRITICAL POC
9.8
CVE-2025-13390 CRITICAL POC
10.0
CVE-2025-66489 CRITICAL POC
9.8
CVE-2026-28446 CRITICAL POC
9.4
CVE-2025-57808 HIGH POC
8.1
CVE-2016-9463 HIGH POC
8.1
CVE-2026-43640 HIGH POC
8.6
CVE-2025-44557 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2022-4861 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy