CVE-2023-2325
Assigner: M-Files Corporation
Published: 2023-10-20T06:39:44.747Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: M-Files Web
vendor: M-Files
versions: lessThan: 23.10
status: affected
version: 0
versionType: custom
status: unaffected
version: 23.2 LTS SR4
status: unaffected
version: 23.8 LTS SR1
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Thomas Riedmaier / Siemens Energy
type: finder
user: 00000000-0000-4000-9000-000000000000
value: Abian Blome / Siemens Energy
datePublic: 2023-10-19T12:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Stored XSS Vulnerability in M-Files Classic Web versions before 23.10&nbsp;a<span style="background-color: rgb(255, 255, 255);">nd LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.</span><br><br>
value: Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.


impacts: capecId: CAPEC-592
descriptions: value: CAPEC-592 Stored XSS
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update to fixed version
value: Update to fixed version
source: defect: 167253
discovery: EXTERNAL
title: Stored XSS Vulnerability in M-Files Classic Web
workarounds: supportingMedia: base64: no
type: text/html
value: None
value: None
x_generator: engine: Vulnogram 0.1.0-dev