CVE-2023-3425
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.
Risk Assessment
The organization may be exposed to sensitive data leakage, potentially leading to privacy and information security breaches.
Recommendation
It is recommended to update M-Files Server to version 23.8.12892.6 or later and to LTS SR3 or later to mitigate this vulnerability.
Other vulnerabilities in M-Files Server
See all- CVE-2026-0983High
In M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3, a denial-of-service vulnerability exists. This allows an authenticated user to cause the MFserver process to crash.
- CVE-2026-0931Medium
Denial-of-service vulnerability in M-Files Server before version 26.5.16015.3 allows an authenticated admin user to crash the server process and prevent it from restarting.
- CVE-2025-13008High
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
- CVE-2023-3405High
Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service.
Original NVD description (English source)
Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS