CVE-2023-4479: 
M-Files Online vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in M-Files Web versions before 23.8. The vulnerability was assigned identifier CVE-2023-4479 and was disclosed on August 22, 2023. The vulnerability affects M-Files Web application and allows attackers to execute scripts on users' browsers via stored HTML documents within a limited time period (M-Files Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.3 (High) and a Temporal Score of 6.4. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, indicating network accessibility, low attack complexity, required low privileges, user interaction, and potential for high confidentiality and integrity impact. The vulnerability is classified as CWE-79 (Cross-Site Scripting) and CAPEC-592 (Stored XSS) (M-Files Advisory).

If successfully exploited, this vulnerability could allow attackers to execute malicious scripts in users' browsers, potentially leading to unauthorized access to sensitive information or manipulation of web content. The vulnerability requires both access to the M-Files Vault to store malicious HTML files and getting a user to open it with a specifically provided link (M-Files Advisory).

The vulnerability has not been publicly disclosed or exploited in the wild. The probability of exploitation is considered low, as it was responsibly reported. Exploitation requires specific conditions: access to M-Files Vault, ability to store malicious HTML files, and user interaction within a limited time window (M-Files Advisory).

Users are advised to upgrade to M-Files Web version 23.8 or later to address this vulnerability. Normal file opening operations from the Vault using M-Files Web would not trigger the vulnerability (M-Files Advisory).