CVE-2022-4862CWE-200

XSS vulnerability in M-Files Web

Medium · published March 6, 2023

CVSS v3.1
5.0
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information.

This issue affects M-Files New Web: before 22.12.12140.3.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-03-06T10:46Z
EPSS history
Timeline
  • 06 MAR 10:46Z
    XSS vulnerability in M-Files Web
    cvelistv5