CVE-2023-2325

Published: Oct 20, 2023Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.

Affected (3)

Products: M Files: Classic Web

M Files

1 product

Classic Web

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
M Files Classic Web	Before 23.10
M Files Classic Web	Version 23.2
M Files Classic Web	Version 23.8

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://empower.m-files.com/security-advisories/CVE-2023-2325

Source: security@m-files.com

https://product.m-files.com/security-advisories/cve-2023-2325/

Source: security@m-files.com

https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2325/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.