CVE-2023-5524CWE-434

M-Files Web Companion allows Remote Code Execution for some filetypes

High · published October 20, 2023

CVSS v3.1
8.2
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows

Remote Code Execution

via specific file types

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00329 · 24.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-10-20T06:41Z
EPSS history
Timeline
  • 20 OCT 06:41Z
    M-Files Web Companion allows Remote Code Execution for some filetypes
    cvelistv5