Medium severity · published Oct 20, 2023
CVE-2023-2325
Stored XSS Vulnerability in M-Files Classic Web
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
M-Files Web · M-Files
before 23.10 · source: vendor
CW
Classic Web · M-files
before 23.10; 23.2; 23.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2325
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2325
empower.m-files.com
https://empower.m-files.com/security-advisories/CVE-2023-2325
product.m-files.com
https://product.m-files.com/security-advisories/cve-2023-2325/
www.m-files.com
https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2325/
More from M-Files Web
9.8
CVE-2021-41807
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and…
7.5
CVE-2021-37253
M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers)
7.5
CVE-2021-37254
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key…
6.5
CVE-2023-3406
Path traversal issue in M-Files Classic Web
5.4
CVE-2025-3087
Stored XSS Vulnerability in M-Files Web