CVE-2023-6910: 
M-Files Server vulnerability analysis and mitigation

A vulnerable API method in M-Files Server before version 23.12.13195.0 was discovered that allows for uncontrolled resource consumption. The vulnerability (CVE-2023-6910) was disclosed on December 18, 2023, affecting M-Files Server installations prior to version 23.12.13195.0, including versions before 23.2 LTS SR6 and 23.8 LTS SR4 (M-Files Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The weakness has been categorized as CWE-770 (Allocation of Resources Without Limits or Throttling). Exploitation requires authentication or anonymous authentication to be enabled in an M-Files vault (M-Files Advisory).

When exploited, this vulnerability allows an authenticated attacker to exhaust server storage space to a point where the server can no longer serve requests, resulting in a denial of service condition (NVD, M-Files Advisory).

The vulnerability has not been publicly exploited and was internally discovered. The probability of exploitation is considered low. The vulnerability requires authentication for exploitation, which limits the potential attack surface (M-Files Advisory).

Users should upgrade to M-Files Server version 23.12.13195.0 or later to address this vulnerability. The service releases 23.2 LTS SR6 and 23.8 LTS SR4 are not affected by this vulnerability (M-Files Advisory).