title: Stored XSS Vulnerability in M-Files Classic Web
description: Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
product: M-Files Web
vendor: M-Files
versions:
lessThan: 23.10, status: affected, version: 0, versionType: custom
status: unaffected, version: 23.2 LTS SR4
status: unaffected, version: 23.8 LTS SR1
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update to fixed version
workarounds: None