CVE-2023-6117: M-Files REST API allows Denial of Service

DESCRIPTION:

A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.

AFFECTED PRODUCTS:

M-Files Server before 23.11.13156.0

MORE INFORMATION:

The REST API method used for uploading and sharing files to the Drive was detected to be vulnerable to a DoS attack, for example, if a large file is loaded and the function is called asynchronously it can result in a DoS attack.

CVSS 3.1 Base Score: 5.7

CVSS 3.1 Temporal Score: 4.9

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R

CWE: CWE-400 Uncontrolled Resource Consumption

CAPEC: CAPEC-130 Excessive Allocation

Internal ID: 167126, 167119

Date issued: 2023-11-22

EXPLOITABILITY

Publicly disclosed: No

Exploited: No

Probability of exploitation: low - internally found

LINKS

https://www.cve.org/CVERecord?id=CVE-2023-6117

HISTORY

2023-11-22 Published