Description
Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.
Scores
CVSS v3
4.8
EPSS
0.0027
EPSS Percentile
50.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-303
CWE-287
Status
published
Products (1)
m-files/m-files_client
< 22.5.11356.0
Published
Dec 30, 2022
Tracked Since
Feb 18, 2026