PT-2023-32820 · M Files · M-Files Server

Published 2023-12-20 · Updated 2026-02-23 · CVE-2023-6912

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 23.12.13205.0

Description The issue is related to a lack of protection against brute force attacks, allowing an attacker to make unlimited authentication attempts. This could potentially compromise targeted M-Files user accounts by guessing passwords.

Recommendations For versions prior to 23.12.13205.0, update to version 23.12.13205.0 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication security measures, such as rate limiting or account lockout policies, to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2023-6912

Affected Products

M-Files Server

References · 10

• https://empower.m-files.com/security-advisories/CVE-2023-6912 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6912 · Vendor Advisory
• https://product.m-files.com/security-advisories/cve-2023-6912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6912 · Security Note
• https://twitter.com/CVEnew/status/1737410596209930695 · Twitter Post
• https://t.me/cvenotify/64368 · Telegram Post
• https://t.me/cvenotify/92447 · Telegram Post
• https://m-files.com/about/trust-center/security-advisories/cve-2023-6912 · Note
• https://twitter.com/VulmonFeeds/status/1737436278151364817 · Twitter Post
• https://t.me/cveNotify/152835 · Telegram Post