Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2023-5524
PUBLISHED
More InfoOfficial Page
Assigner-M-Files Corporation
Assigner Org ID-bcf7a16e-bfdc-46e4-9e42-4187da3f4410
View Known Exploited Vulnerability (KEV) details
Published At-20 Oct, 2023 | 06:41
Updated At-23 Feb, 2026 | 08:54
Rejected At-
▼CVE Numbering Authority (CNA)
M-Files Web Companion allows Remote Code Execution for some filetypes

Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types

Affected Products
Vendor
M-Files OyM-Files
Product
Web Companion
Default Status
unaffected
Versions
Affected
  • From 23.3 before 23.10 (custom)
Unaffected
  • 23.8 LTS SR1
Problem Types
TypeCWE IDDescription
CWECWE-434CWE-434 Unrestricted Upload of File with Dangerous Type
Type: CWE
CWE ID: CWE-434
Description: CWE-434 Unrestricted Upload of File with Dangerous Type
Metrics
VersionBase scoreBase severityVector
3.18.2HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Version: 3.1
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-253CAPEC-253 Remote Code Inclusion
CAPEC ID: CAPEC-253
Description: CAPEC-253 Remote Code Inclusion
Solutions

Update to fixed version

Configurations
Workarounds
Exploits

None publicly available

Credits
finder
Anton Keskisaari / Second Nature Security
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://product.m-files.com/security-advisories/cve-2023-5524/
vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2023-5524
vendor-advisory
Hyperlink: https://product.m-files.com/security-advisories/cve-2023-5524/
Resource:
vendor-advisory
Hyperlink: https://empower.m-files.com/security-advisories/CVE-2023-5524
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.m-files.com/about/trust-center/security-advisories/cve-2023-5524/
x_transferred
Hyperlink: https://www.m-files.com/about/trust-center/security-advisories/cve-2023-5524/
Resource:
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found