Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2022-1606
PUBLISHED
More InfoOfficial Page
Assigner-M-Files Corporation
Assigner Org ID-bcf7a16e-bfdc-46e4-9e42-4187da3f4410
View Known Exploited Vulnerability (KEV) details
Published At-30 Nov, 2022 | 14:05
Updated At-23 Feb, 2026 | 07:54
Rejected At-
▼CVE Numbering Authority (CNA)
Incorrect privilege assignment in M-Files Server

Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects.

Affected Products
Vendor
M-Files OyM-Files
Product
M-Files Server
Default Status
unaffected
Versions
Affected
  • From 0 before 22.3.11164.0 (custom)
  • From 0 before 22.3.11237.1 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-269CWE-269 Improper Privilege Management
Type: CWE
CWE ID: CWE-269
Description: CWE-269 Improper Privilege Management
Metrics
VersionBase scoreBase severityVector
3.12.4LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Version: 3.1
Base score: 2.4
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-233CAPEC-233 Privilege Escalation
CAPEC ID: CAPEC-233
Description: CAPEC-233 Privilege Escalation
Solutions

Upgrade to non-affected version.

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.m-files.com/about/trust-center/security-advisories/cve-2022-1606/
vendor-advisory
https://product.m-files.com/security-advisories/cve-2022-1606/
vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2022-1606
vendor-advisory
Hyperlink: https://www.m-files.com/about/trust-center/security-advisories/cve-2022-1606/
Resource:
vendor-advisory
Hyperlink: https://product.m-files.com/security-advisories/cve-2022-1606/
Resource:
vendor-advisory
Hyperlink: https://empower.m-files.com/security-advisories/CVE-2022-1606
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.m-files.com/about/trust-center/security-advisories/cve-2022-1606/
vendor-advisory
x_transferred
Hyperlink: https://www.m-files.com/about/trust-center/security-advisories/cve-2022-1606/
Resource:
vendor-advisory
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found