CVE-2023-2112 - Vulnerability Details - OpenCVE

Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00027.

Key SSVC decision points have not yet been added.

Vendors	Products
M-files	M-files Server

Configuration 1 [-]

cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-33633	Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.

Fixes

Solution

Update to the patched version.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://product.m-files.com/security-advisories/cve-2023-2112/
https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2112/

History

Wed, 28 Aug 2024 20:30:00 +0000

Type	Values Removed	Values Added
References		https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2112/

Wed, 28 Aug 2024 09:30:00 +0000

Type	Values Removed	Values Added
References	https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2112/

Wed, 28 Aug 2024 08:45:00 +0000

Type	Values Removed	Values Added
Description	Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.	Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.
References		https://product.m-files.com/security-advisories/cve-2023-2112/

MITRE

Status: PUBLISHED

Assigner: M-Files Corporation

Published: 2023-04-20T08:05:52.085Z

Updated: 2024-08-28T19:27:53.050Z

Reserved: 2023-04-17T08:52:30.318Z

Link: CVE-2023-2112

Vulnrichment

Updated: 2024-08-02T06:12:20.335Z

NVD

Status : Modified

Published: 2023-04-20T09:15:10.540

Modified: 2024-11-21T07:57:57.813

Link: CVE-2023-2112

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-2112", "assignerOrgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "state": "PUBLISHED", "assignerShortName": "M-Files Corporation", "dateReserved": "2023-04-17T08:52:30.318Z", "datePublished": "2023-04-20T08:05:52.085Z", "dateUpdated": "2024-08-28T19:27:53.050Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "M-Files Desktop", "vendor": "M-Files", "versions": [{"lessThan": "23.4.12455.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2023-04-18T07:54:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. "}], "value": "Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "shortName": "M-Files Corporation", "dateUpdated": "2024-08-28T08:33:36.538Z"}, "references": [{"url": "https://product.m-files.com/security-advisories/cve-2023-2112/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to the patched version. "}], "value": "Update to the patched version."}], "source": {"discovery": "INTERNAL"}, "title": "Desktop component allows lateral movement between sessions", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:12:20.335Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2112/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-28T19:27:36.657301Z", "id": "CVE-2023-2112", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T19:27:53.050Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2112/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:12:20.335Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-2112", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-28T19:27:36.657301Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T19:27:48.333Z"}}], "cna": {"title": "Desktop component allows lateral movement between sessions", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "M-Files", "product": "M-Files Desktop", "versions": [{"status": "affected", "version": "0", "lessThan": "23.4.12455.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to the patched version.", "supportingMedia": [{"type": "text/html", "value": "Update to the patched version. ", "base64": false}]}], "datePublic": "2023-04-18T07:54:00.000Z", "references": [{"url": "https://product.m-files.com/security-advisories/cve-2023-2112/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.", "supportingMedia": [{"type": "text/html", "value": "Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "shortName": "M-Files Corporation", "dateUpdated": "2024-08-28T08:33:36.538Z"}}}, "cveMetadata": {"cveId": "CVE-2023-2112", "state": "PUBLISHED", "dateUpdated": "2024-08-28T19:27:53.050Z", "dateReserved": "2023-04-17T08:52:30.318Z", "assignerOrgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "datePublished": "2023-04-20T08:05:52.085Z", "assignerShortName": "M-Files Corporation"}, "dataVersion": "5.1"}