CVE-2023-6239

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://product.m-files.com/security-advisories/cve-2023-6239/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:m-files:m-files_server::::::::
	cpe:2.3:a:m-files:m-files_server:23.9:::::::*
	cpe:2.3:a:m-files:m-files_server:23.10:::::::*

History

28 Aug 2024, 09:15

Type	Values Removed	Values Added
References	~~{'url': 'https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6239/', 'tags': ['Broken Link'], 'source': 'security@m-files.com'}~~	() https://product.m-files.com/security-advisories/cve-2023-6239/ -
Summary	(en) Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.	(en) Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.

04 Dec 2023, 19:06

Type	Values Removed	Values Added
CWE		CWE-281
CPE		cpe:2.3:a:m-files:m-files_server:::::::: cpe:2.3:a:m-files:m-files_server:23.9:::::::* cpe:2.3:a:m-files:m-files_server:23.10:::::::*
References	~~() https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6239/ -~~	() https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6239/ - Broken Link
First Time		M-files m-files Server M-files
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8

30 Nov 2023, 16:15

Type	Values Removed	Values Added
Summary	Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before 23.11.13168.7 allowing user to access object with incorrectly calculated privileges.	Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.

29 Nov 2023, 14:15

Type	Values Removed	Values Added
Summary	Improperly calculated effective permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before 23.11.13168.7 could produce a faulty result if an object used a specific configuration of metadata-driven permissions.	Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before 23.11.13168.7 allowing user to access object with incorrectly calculated privileges.

28 Nov 2023, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-28 14:15

Updated : 2024-08-28 09:15

NVD link : CVE-2023-6239

Mitre link : CVE-2023-6239

CVE.ORG link : CVE-2023-6239

JSON object : View

Products Affected

m-files

m-files_server

CWE

CWE-281

Improper Preservation of Permissions

8.8 /10