Medium · 6.5 CVE-2022-3284 EUVD-2022-42680GHSA-r92f-q253-q9wv

Insecure way of passing a download key

Published Mar 6, 2023 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Vendor: M-Files Product: M-Files New Web

Description

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0.
This issue affects M-Files New Web: before 22.11.12011.0.

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files New Web	< 22.11.12011.0	22.11.12011.0

References

https://www.m-files.com/about/trust-center/security-advisories/cve-2022-3284/ vendor-advisory
https://product.m-files.com/security-advisories/cve-2022-3284/ vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2022-3284 vendor-advisory