Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in M-Files Server ausnutzen, um Benutzerrechte anderer Nutzer zu erlangen und Informationen offenzulegen.
Product
M-Files ist eine Plattform zur Verwaltung von Unternehmensinformationen.
Vulnerabilities 2
-
High 8.6
Session Token Disclosure in M-Files Web
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
-
Medium 5.6
Unintended temporary cached data included in a structure only copy intended to be empty of data
Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7
Revision history
-
#1
Initiale Fassung
References
-
M-Files Security Advisory vom 2025-12-18
https://product.m-files.com/security-advisories/cve-2025-13008/
-
M-Files Security Advisory vom 2025-12-18
https://product.m-files.com/security-advisories/cve-2025-14267/