CVE-2023-6910: 
M-Files Server vulnerability analysis and mitigation

A vulnerable API method in M-Files Server before version 23.12.13195.0 was discovered that allows for uncontrolled resource consumption. The vulnerability (CVE-2023-6910) was disclosed on December 18, 2023, affecting M-Files Server installations prior to version 23.12.13195.0, including versions before 23.2 LTS SR6 and 23.8 LTS SR4 (M-Files Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The weakness has been categorized as CWE-770 (Allocation of Resources Without Limits or Throttling). Exploitation requires authentication or anonymous authentication to be enabled in an M-Files vault (M-Files Advisory).

When exploited, this vulnerability allows an authenticated attacker to exhaust server storage space to a point where the server can no longer serve requests, resulting in a denial of service condition (NVD, M-Files Advisory).

Users should upgrade to M-Files Server version 23.12.13195.0 or later to address this vulnerability. The service releases 23.2 LTS SR6 and 23.8 LTS SR4 are not affected by this vulnerability (M-Files Advisory).