Lucene search

M-Files CorporationVULNRICHMENT:CVE-2022-4862

HistoryMar 06, 2023 - 10:46 a.m.

CVE-2022-4862 XSS vulnerability in M-Files Web

2023-03-0610:46:20

CWE-200

M-Files Corporation

github.com

xss vulnerability

m-files web

html rendering

authenticated user

sensitive information

cve-2022-4862

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

29.2%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information.

This issue affects M-Files New Web: before 22.12.12140.3.

References

product.m-files.com/security-advisories/cve-2022-4862/

www.m-files.com/about/trust-center/security-advisories/cve-2022-4862/

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

29.2%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2022-4862