CVE-2023-2325: high-severity vulnerability in M-Files Web
Stored XSS Vulnerability in M-Files Classic Web
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.5%
Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected products
M-Files · M-Files WebRelated CVEs — M-Files Web
In the same product, most dangerous first.
CVE-2021-41807HIGHLack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.EPSS 1.1%CVE-2023-3406HIGHPath traversal issue in M-Files Classic WebEPSS 0.7%CVE-2022-4270LOWIncorrect privilege assignment in M-Files Web ServerEPSS 0.6%CVE-2022-4264MEDIUMIncorrect privilege assignment in M-Files Web ServerEPSS 0.5%