CVE-2025-0619: 
M-Files Server vulnerability analysis and mitigation

CVE-2025-0619 is a security vulnerability affecting M-Files Server versions before 25.1.14445.5, discovered and disclosed on January 23, 2025. The vulnerability involves unsafe password recovery from configuration in M-Files Server that allows highly privileged users to recover external connector passwords (M-Files Advisory).

The vulnerability is classified as CWE-522: Insufficiently Protected Credentials. It has received a CVSS 4.0 Base Score of 4.6 with the vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N. The technical issue specifically affects EOT (External Object Type) connectors, which are not enabled by default in the system (M-Files Advisory).

The vulnerability's impact is limited to scenarios where multiple admin users exist on the same M-Files Vault with varying privileges to external systems where EOT is connected. It's important to note that this vulnerability does not affect any other type of user or administrative passwords (M-Files Advisory).

The vulnerability has been addressed in M-Files Server version 25.1.14445.5. Users are advised to upgrade to this version or later to mitigate the vulnerability (M-Files Advisory).