Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2022-4270

Summary
Assigner-M-Files Corporation
Assigner Org ID-bcf7a16e-bfdc-46e4-9e42-4187da3f4410
Published At-02 Dec, 2022 | 12:20
Updated At-28 Aug, 2024 | 11:15
Rejected At-
Credits

Incorrect privilege assignment in M-Files Web Server

Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:M-Files Corporation
Assigner Org ID:bcf7a16e-bfdc-46e4-9e42-4187da3f4410
Published At:02 Dec, 2022 | 12:20
Updated At:01 Jan, 1000 | 00:00
Rejected At:
▼CVE Numbering Authority (CNA)
Incorrect privilege assignment in M-Files Web Server

Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally.

Affected Products
Vendor
M-Files OyM-Files
Product
M-Files Web
Default Status
unaffected
Versions
Affected
  • From 0 before 22.5.11436.1 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-269CWE-269 Improper Privilege Management
Type: CWE
CWE ID: CWE-269
Description: CWE-269 Improper Privilege Management
Metrics
VersionBase scoreBase severityVector
3.12.0LOW
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Version: 3.1
Base score: 2.0
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-122CAPEC-122 Privilege Abuse
CAPEC ID: CAPEC-122
Description: CAPEC-122 Privilege Abuse
Solutions

Upgrade to non-affected version.

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4270/
N/A
Hyperlink: https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4270/
Resource: N/A
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@m-files.com
Published At:02 Dec, 2022 | 13:15
Updated At:28 Aug, 2024 | 11:15

Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.12.6LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Secondary3.12.0LOW
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Type: Primary
Version: 3.1
Base score: 2.6
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Type: Secondary
Version: 3.1
Base score: 2.0
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
CPE Matches
M-Files Oy
m-files
>>m-files_server>>Versions before 22.5.11436.1(exclusive)
cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-269Primarynvd@nist.gov
CWE-269Secondarysecurity@m-files.com
CWE ID: CWE-269
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-269
Type: Secondary
Source: security@m-files.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://product.m-files.com/security-advisories/cve-2022-4270/security@m-files.com
N/A
https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4270/security@m-files.com
Vendor Advisory
Hyperlink: https://product.m-files.com/security-advisories/cve-2022-4270/
Source: security@m-files.com
Resource: N/A
Hyperlink: https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4270/
Source: security@m-files.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

2Records found
CVE-2022-4264
Matching Score-6
Assigner-M-Files Corporation
ShareView Details
Matching Score-6
Assigner-M-Files Corporation
CVSS Score-6.5||MEDIUM
EPSS-0.10% / 28.58%
||
7 Day CHG~0.00%
Published-09 Dec, 2022 | 14:08
Updated-28 Aug, 2024 | 11:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Incorrect privilege assignment in M-Files Web Server

Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration.

Action-Not Available
Vendor-M-Files Oy
Product-m-filesM-Files Web
CWE ID-CWE-269
Improper Privilege Management
CVE-2022-1606
Matching Score-6
Assigner-M-Files Corporation
ShareView Details
Matching Score-6
Assigner-M-Files Corporation
CVSS Score-2.4||LOW
EPSS-0.14% / 35.20%
||
7 Day CHG+0.03%
Published-30 Nov, 2022 | 14:05
Updated-28 Aug, 2024 | 11:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Incorrect privilege assignment in M-Files Server

Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects.

Action-Not Available
Vendor-M-Files Oy
Product-m-files_serverM-Files Server
CWE ID-CWE-269
Improper Privilege Management
Details not found