CVE-2022-39019 - Broken access controls on PDFtron WebviewerUI in M-Files Hubshare

Back Back to CVE browser

HIGH

Broken access controls on PDFtron WebviewerUI in M-Files Hubshare

Published Oct 31, 2022

7.5

HIGH

CVSS 3.1

EPSS 0.41%

Description

Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.

Affected products

Vendor M-Files Product Hubshare Default
unaffected
Affected
- 3.3.1.6

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
M-Files	Hubshare	unaffected	Affected 3.3.1.6

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-434

Unrestricted Upload of File

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41565
Advisory
https://www.themissinglink.com.au/security-advisories/cve-2022-39019
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41565		Advisory
https://www.themissinglink.com.au/security-advisories/cve-2022-39019		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner TML

Published Oct 31, 2022

Updated May 2, 2025

Reserved Aug 30, 2022

Link CVE-2022-39019

CISA Vulnrichment

Updated May 2, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-39019

Red Hat

No data

ENISA EUVD

Assigner TML

Published Oct 31, 2022

Updated May 2, 2025

Link EUVD-2022-41565

GitHub

No data