Lucene search

M-Files CorporationCVELIST:CVE-2022-4862

HistoryMar 06, 2023 - 10:46 a.m.

CVE-2022-4862 XSS vulnerability in M-Files Web

2023-03-0610:46:20

CWE-200

M-Files Corporation

www.cve.org

xss

m-files web

html rendering

authenticated users

sensitive information

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information.

This issue affects M-Files New Web: before 22.12.12140.3.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "M-Files New Web",
    "vendor": "M-Files",
    "versions": [
      {
        "lessThan": "22.12.12140.3",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

product.m-files.com/security-advisories/cve-2022-4862/

www.m-files.com/about/trust-center/security-advisories/cve-2022-4862/

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

Related for CVELIST:CVE-2022-4862