PT-2023-32573 · M Files · M-Files Server

Published 2023-11-28 · Updated 2024-08-28 · CVE-2023-6239

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions M-Files Server versions 23.9 through 23.11 before 23.11.13168.7

Description The issue arises under rare conditions when an object in M-Files Server has a specific configuration of metadata-driven permissions, potentially leading to incorrect calculation of the object's effective permissions. This could enable unauthorized access to the object.

Recommendations For M-Files Server versions 23.9 through 23.11 before 23.11.13168.7, update to version 23.11.13168.7 or later to resolve the issue.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2023-6239

Affected Products

M-Files Server

References · 7

• https://empower.m-files.com/security-advisories/CVE-2023-6239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6239 · Security Note
• https://m-files.com/about/trust-center/security-advisories/cve-2023-6239 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6239 · Vendor Advisory
• https://product.m-files.com/security-advisories/cve-2023-6239 · Vendor Advisory
• https://t.me/cvenotify/61442 · Telegram Post
• https://t.me/cvenotify/62162 · Telegram Post