CVE-2023-0213 - Vulnerability Details - OpenCVE

Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00029.

Key SSVC decision points have not yet been added.

Vendors	Products
M-files Subscribe	M-files Subscribe
Microsoft Subscribe	Windows Subscribe

Configuration 1 [-]

AND

cpe:2.3:a:m-files:m-files:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-12302	Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.

Fixes

Solution

Update to version 22.6 or newer.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://product.m-files.com/security-advisories/cve-2023-0213/
https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0213/

History

Thu, 29 Aug 2024 05:30:00 +0900

Type	Values Removed	Values Added
References		https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0213/

Wed, 28 Aug 2024 18:30:00 +0900

Type	Values Removed	Values Added
References	https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0213/

Wed, 28 Aug 2024 18:00:00 +0900

Type	Values Removed	Values Added
References		https://product.m-files.com/security-advisories/cve-2023-0213/

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: M-Files Corporation

Published: 2023-03-29T10:22:45.724Z

Updated: 2024-08-28T19:37:22.593Z

Reserved: 2023-01-11T09:26:15.276Z

Link: CVE-2023-0213

Vulnrichment

Updated: 2024-08-02T05:02:44.055Z

NVD

Status : Modified

Published: 2023-03-29T11:15:07.033

Modified: 2024-11-21T07:36:45.587

Link: CVE-2023-0213

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-427

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-0213", "assignerOrgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "state": "PUBLISHED", "assignerShortName": "M-Files Corporation", "dateReserved": "2023-01-11T09:26:15.276Z", "datePublished": "2023-03-29T10:22:45.724Z", "dateUpdated": "2024-08-28T19:37:22.593Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "M-Files", "vendor": "M-Files", "versions": [{"lessThan": "22.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Alexander Staalgaard"}], "datePublic": "2023-03-29T10:01:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking."}], "value": "Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "No publicly available exploit."}], "value": "No publicly available exploit."}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "shortName": "M-Files Corporation", "dateUpdated": "2024-08-28T08:47:21.229Z"}, "references": [{"url": "https://product.m-files.com/security-advisories/cve-2023-0213/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to version 22.6 or newer."}], "value": "Update to version 22.6 or newer."}], "source": {"discovery": "EXTERNAL"}, "title": "Local Elevation of Privilege in M-Files", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:02:44.055Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0213/", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "m-files", "product": "m-files", "cpes": ["cpe:2.3:a:m-files:m-files:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "22.6", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-28T19:36:25.883978Z", "id": "CVE-2023-0213", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T19:37:22.593Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0213/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:02:44.055Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-0213", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-28T19:36:25.883978Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:m-files:m-files:-:*:*:*:*:*:*:*"], "vendor": "m-files", "product": "m-files", "versions": [{"status": "affected", "version": "0", "lessThan": "22.6", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T19:37:04.452Z"}}], "cna": {"title": "Local Elevation of Privilege in M-Files", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Alexander Staalgaard"}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "M-Files", "product": "M-Files", "versions": [{"status": "affected", "version": "0", "lessThan": "22.6", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "No publicly available exploit.", "supportingMedia": [{"type": "text/html", "value": "No publicly available exploit.", "base64": false}]}], "solutions": [{"lang": "en", "value": "Update to version 22.6 or newer.", "supportingMedia": [{"type": "text/html", "value": "Update to version 22.6 or newer.", "base64": false}]}], "datePublic": "2023-03-29T10:01:00.000Z", "references": [{"url": "https://product.m-files.com/security-advisories/cve-2023-0213/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.", "supportingMedia": [{"type": "text/html", "value": "Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "shortName": "M-Files Corporation", "dateUpdated": "2024-08-28T08:47:21.229Z"}}}, "cveMetadata": {"cveId": "CVE-2023-0213", "state": "PUBLISHED", "dateUpdated": "2024-08-28T19:37:22.593Z", "dateReserved": "2023-01-11T09:26:15.276Z", "assignerOrgId": "bcf7a16e-bfdc-46e4-9e42-4187da3f4410", "datePublished": "2023-03-29T10:22:45.724Z", "assignerShortName": "M-Files Corporation"}, "dataVersion": "5.1"}