CVE-2023-6239

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6239
Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6239/ Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:*
cpe:2.3:a:m-files:m-files_server:23.9:*:*:*:*:*:*:*
cpe:2.3:a:m-files:m-files_server:23.10:*:*:*:*:*:*:*
History

04 Dec 2023, 19:06

Type Values Removed Values Added
References () https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6239/ - () https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6239/ - Broken Link
CWE CWE-281
CPE cpe:2.3:a:m-files:m-files_server:23.10:*:*:*:*:*:*:*
cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:*
cpe:2.3:a:m-files:m-files_server:23.9:*:*:*:*:*:*:*
First Time M-files m-files Server
M-files
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

30 Nov 2023, 16:15

Type Values Removed Values Added
Summary Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before 23.11.13168.7 allowing user to access object with incorrectly calculated privileges. Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.

29 Nov 2023, 14:15

Type Values Removed Values Added
Summary Improperly calculated effective permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before 23.11.13168.7 could produce a faulty result if an object used a specific configuration of metadata-driven permissions. Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before 23.11.13168.7 allowing user to access object with incorrectly calculated privileges.

28 Nov 2023, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-28 14:15

Updated : 2023-12-10 15:26

NVD link : CVE-2023-6239

Mitre link : CVE-2023-6239

CVE.ORG link : CVE-2023-6239

JSON object : View

Products Affected

m-files

  • m-files_server
CWE
CWE-281

Improper Preservation of Permissions