CVE-2022-4264: 
M-Files Desktop vulnerability analysis and mitigation

CVE-2022-4264 is a security vulnerability discovered in M-Files Web (Classic) versions prior to 22.8.11691.0, disclosed on December 9, 2022. The vulnerability involves an incorrect privilege assignment that allows users with low privileges to modify certain configuration settings (M-Files Advisory).

The vulnerability has been assigned a CVSS 3.1 base score of 6.5 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. It is classified under CWE-269 (Improper Privilege Management) and CAPEC-176 (Configuration/Environment Manipulation). The vulnerability requires network access and low privileges to exploit, with no user interaction needed (M-Files Advisory).

When exploited, this vulnerability allows low-privileged users to modify limited local web configuration data affecting M-Files Web. While there is no impact on confidentiality or availability, the integrity impact is rated as high (M-Files Advisory).

The vulnerability has been patched in M-Files version 22.8.11691.0. Organizations using affected versions of M-Files Web Classic should upgrade to this version or later to mitigate the vulnerability (M-Files Advisory).