Description
A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.
Affected products
M-Files Server before 23.11.13156.0
More information
The REST API method used for uploading and sharing files to the Drive was detected to be vulnerable to a DoS attack, for example, if a large file is loaded and the function is called asynchronously it can result in a DoS attack. CVSS 3.1 Base Score: 5.7 CVSS 3.1 Temporal Score: 4.9 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R CWE: CWE-770 Allocation of Resources Without Limits or Throttling CAPEC: CAPEC-130 Excessive Allocation Internal ID: 167126, 167119 Date issued: 2023-11-22
Exploitability
Publicly disclosed: No Exploited: No Probability of exploitation: low – internally found
