Description
Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows
Remote Code Execution
via specific file types
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| M-Files | Web Companion | 23.3 – < 23.10 | 23.10 |
References
- https://product.m-files.com/security-advisories/cve-2023-5524/ vendor-advisory
- https://empower.m-files.com/security-advisories/CVE-2023-5524 vendor-advisory