Vulnerability · Published Aug 25, 2023 · Assigned by M-Files Corporation
CVE-2023-3406Path traversal issue in M-Files Classic Web
High 7.7
In plain English
A high-severity path traversal in M-Files Web from M-Files. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| M-Files | M-Files Web | 0 – before 23.6.12695.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://product.m-files.com/security-advisories/cve-2023-3406/ vendor-advisory
- https://empower.m-files.com/security-advisories/CVE-2023-3406 vendor-advisory
- https://www.m-files.com/about/trust-center/security-advisories/cve-2023-3406 vendor-advisory, x_transferred