CVE-2023-2325 in Classic Web
Summary
by MITRE • 10/25/2023
Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/21/2025
The stored cross-site scripting vulnerability identified as CVE-2023-2325 affects M-Files Classic Web applications across multiple version ranges including pre-23.10 releases and specific LTS service releases before 23.2 LTS SR4 and 23.8 LTS SR1. This vulnerability represents a critical security flaw that enables attackers to inject malicious scripts into web applications through stored HTML documents, creating persistent threats that can compromise user sessions and data integrity. The vulnerability stems from insufficient input validation and output encoding mechanisms within the document storage and rendering processes of the M-Files platform.
The technical implementation of this flaw occurs when users upload or store HTML documents containing malicious script code within the M-Files Classic Web environment. When other users subsequently access these stored documents through the web interface, the embedded scripts execute in their browser context without proper sanitization or escaping. This allows attackers to perform various malicious activities including session hijacking, credential theft, data exfiltration, and redirection to malicious sites. The vulnerability specifically targets the document rendering pipeline where HTML content is processed and displayed to end users, making it particularly dangerous in collaborative document management environments where multiple users frequently access shared content.
The operational impact of this vulnerability extends beyond simple script execution to encompass significant risks for enterprise security posture and compliance requirements. Organizations utilizing M-Files Classic Web solutions face potential data breaches, unauthorized access to sensitive documents, and compromise of user authentication tokens. Attackers can leverage this vulnerability to establish persistent access to document repositories, potentially gaining access to confidential business information, intellectual property, and personal data. The stored nature of the vulnerability means that impacts can persist long after initial exploitation, creating ongoing security risks that may go undetected for extended periods.
Mitigation strategies for CVE-2023-2325 should prioritize immediate application of vendor patches and updates to the affected M-Files Classic Web versions. Organizations must implement comprehensive input validation mechanisms, including strict content filtering and sanitization of all user-uploaded HTML content before storage. Network segmentation and access controls should be strengthened to limit potential attack surfaces, while security monitoring systems should be enhanced to detect anomalous script execution patterns. The vulnerability aligns with CWE-79 (Cross-site Scripting) and maps to ATT&CK techniques including T1059.007 (Command and Scripting Interpreter: JavaScript) and T1566.001 (Phishing: Spearphishing Attachment) demonstrating the multi-faceted nature of the threat. Regular security assessments and penetration testing should be conducted to verify the effectiveness of implemented controls, while user awareness training should emphasize the dangers of accessing untrusted document content. Additionally, organizations should establish incident response procedures specifically addressing stored XSS vulnerabilities to ensure rapid containment and remediation of exploitation attempts.