CVE-2023-3406

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-340609.8VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 CVE-2023-340617.5Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this v CVE-2023-340627.5In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a CVE-2023-340638.3Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading CVE-2023-340644.6Workspace ONE Launcher contains a Privilege Escalation Vulnerability. A malicious actor with physical access to Workspace ONE Launcher could CVE-2023-34074.3The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to miss CVE-2023-34084.3The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing o CVE-2023-340854.3When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously CVE-2023-340866.7Improper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via l CVE-2023-340877.8An improper array index validation vulnerability exists in the EVCD var len parsing functionality of GTKWave 3.3.115. A specially crafted .e CVE-2023-340885.4Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online pri CVE-2023-340896.1Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and