CVE-2023-6117: M-Files REST API allows Denial of Service
DESCRIPTION
A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.
AFFECTED PRODUCTS
M-Files Server before 23.11.13156.0
MORE INFORMATION
The REST API method used for uploading and sharing files to the Drive was detected to be vulnerable to a DoS attack, for example, if a large file is loaded and the function is called asynchronously it can result in a DoS attack.
CVSS 3.1 Base Score: 5.7
CVSS 3.1 Temporal Score: 4.9
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R
CWE: CWE-770 Allocation of Resources Without Limits or Throttling
CAPEC: CAPEC-130 Excessive Allocation
Internal ID: 167126, 167119
Date issued: 2023-11-22
EXPLOITABILITY
Publicly disclosed: No
Exploited: No
Probability of exploitation: low – internally found
LINKS
https://www.cve.org/CVERecord?id=CVE-2023-6117
HISTORY
2023-11-22 Published
2024-08-28 CWE Updated