Advisories · Technology

M-Files Web.

Every CVE that names M-Files Web among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-2325 CVE record

CVSS 7.3 High

Stored XSS Vulnerability in M-Files Classic Web
- M-Files Web
- Cross-site scripting (XSS)
Not analysed yet 20 Oct 2023
CVE-2023-3406 CVE record

CVSS 7.7 High

Path traversal issue in M-Files Classic Web
- M-Files Web
- Path traversal
Not analysed yet 25 Aug 2023
CVE-2022-4264 CVE record

CVSS 6.5 Medium

Incorrect privilege assignment in M-Files Web Server
- M-Files Web
- Privilege escalation
Not analysed yet 9 Dec 2022
CVE-2022-4270 CVE record

CVSS 2.0 Low

Incorrect privilege assignment in M-Files Web Server
- M-Files Web
- Privilege escalation
Not analysed yet 2 Dec 2022
CVE-2021-41807 CVE record

CVSS 7.5 High

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.
- M-Files Server
- M-Files Web
- Authentication bypass
Not analysed yet 18 Jan 2022