CVE-2023-2112: 
M-Files Server vulnerability analysis and mitigation

A security vulnerability was identified in M-Files Desktop component service, tracked as CVE-2023-2112. The vulnerability affects M-Files Desktop versions prior to 23.4.12455.0, allowing lateral movement between sessions. The issue was discovered and publicly disclosed on April 20, 2023 (M-Files Advisory).

The vulnerability is related to improper access control (CWE-284) in the Desktop component service launch session status function. It has been assigned a CVSS 3.1 score of 3.6 with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating a low to moderate severity. The attack requires local access and high attack complexity, with low privileges required and no user interaction needed (M-Files Advisory).

The vulnerability could potentially lead to unauthorized access between different sessions in M-Files, affecting the confidentiality and integrity of the system at a low level. The availability of the system is not impacted according to the CVSS metrics (M-Files Advisory).

Users are advised to upgrade to M-Files Desktop version 23.4.12455.0 or later to address this vulnerability (M-Files Advisory).