CVE-2023-6912: 
M-Files Server vulnerability analysis and mitigation

CVE-2023-6912 is a security vulnerability affecting M-Files Server versions prior to 23.12.13205.0. The vulnerability was discovered and disclosed on December 19, 2023. It involves a lack of protection against brute force attacks in the M-Files Server authentication system, which allows attackers to perform unlimited authentication attempts against targeted user accounts (M-Files Advisory).

The vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) and has received a CVSS v3.1 base score of 7.5 (High) from M-Files Corporation, while NIST assigned a more severe CVSS v3.1 base score of 9.8 (Critical). The vulnerability specifically affects certain API methods offered by M-Files Server that lack proper rate limiting or authentication attempt restrictions (NVD, M-Files Advisory).

If exploited, this vulnerability could allow attackers to compromise targeted M-Files user accounts through password guessing attacks. The potential impact primarily affects the confidentiality of user accounts, as successful exploitation could lead to unauthorized access to sensitive information (M-Files Advisory).

According to M-Files' assessment, the vulnerability has not been publicly exploited, and the probability of exploitation is considered low. The vulnerability was discovered internally, which reduces the likelihood of immediate exploitation in the wild (M-Files Advisory).

The vulnerability has been patched in M-Files Server version 23.12.13205.0. Additionally, M-Files Server versions 23.2 LTS SR6 and 23.8 LTS SR4 are not affected by this vulnerability. Organizations using affected versions should upgrade to the patched version to protect against potential brute force attacks (M-Files Advisory).