Skip to content
OpenAdvisories
Medium WID-SEC-2025-0707 3 CVEs

M-Files Server: Mehrere Schwachstellen

Published Apr 3, 2025 · Updated Apr 3, 2025 · de-DE

Vendor: M-Files Product: Server

Summary

Ein Angreifer kann mehrere Schwachstellen in M-Files M-Files Server ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten und einen Denial-of-Service-Zustand zu verursachen.

Product

M-Files ist eine Plattform zur Verwaltung von Unternehmensinformationen.

Vulnerabilities 3

  • Medium 6.3
    CVE-2025-3086

    User in anonymous role could create and delete views

    Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial of service

    M-Files M-Files Server
  • Medium 5.1
    CVE-2025-2159

    Stored XSS in M-Files Admin user interface

    Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI

    M-Files M-Files Admin
  • Medium 5.1
    CVE-2025-3087

    Stored XSS Vulnerability in M-Files Web

    Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts

    M-Files M-Files Web

Revision history

  1. #1

    Initiale Fassung

References