Skip to main content

M Files CVE-2023-2480

HIGH
Improper Handling of Insufficient Permissions or Privileges (CWE-280)
2023-05-25 security@m-files.com
Information Disclosure M Files
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 25, 2023 - 14:15 nvd
HIGH 7.8

DescriptionNVD

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

AnalysisAI

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-280. Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications Affected products include: M-Files. Version information: before 23.5.12598.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in M Files

View all
CVE-2021-37253 HIGH POC
7.5 Dec 05

M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range o
CVE-2023-6912 CRITICAL
9.8 Dec 20

Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authe
CVE-2024-10127 CRITICAL
9.2 Nov 20

Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLD
CVE-2023-6239 HIGH
8.8 Nov 28

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specif
CVE-2022-39016 HIGH
8.8 Oct 31

Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account
CVE-2024-6881 HIGH
8.5 Jul 29

Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript

CVE-2024-6124 HIGH
8.5 Jul 29

Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the

CVE-2024-6789 HIGH
8.4 Aug 27

A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 2
CVE-2023-5523 HIGH
7.8 Oct 20

Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versi
CVE-2023-2112 HIGH
7.8 Apr 20

Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. Rated high severity (
CVE-2023-0213 HIGH
7.8 Mar 29

Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges

CVE-2024-4056 HIGH
7.5 Apr 26

Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allow

Same weakness CWE-280 – Improper Handling of Insufficient Permissions or Privileges

View all
CVE-2024-24116 CRITICAL POC
9.8
CVE-2024-25108 HIGH POC
8.8
CVE-2023-27087 HIGH POC
7.5
CVE-2022-4863 MEDIUM POC
6.5
CVE-2021-38312 MEDIUM POC
6.5
CVE-2025-46066 CRITICAL
9.9
CVE-2024-46988 MEDIUM POC
5.7
CVE-2026-41566 CRITICAL
9.4

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2023-2480 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy