Summary
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in M-Files Server ausnutzen, um Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.
Product
M-Files ist eine Plattform zur Verwaltung von Unternehmensinformationen.
Vulnerabilities 2
-
Critical 9.2
Support for authentication bypass condition in M-Files LDAP authentication
Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a password when the LDAP server itself had the vulnerable configuration.
-
Medium 5.3
Local file inclusion vulnerability in M-Files Server
Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read server local files of a limited set of filetypes via document preview.
Revision history
-
#1
Initiale Fassung
References
-
M-Files Security Advisory vom 2024-11-19
https://product.m-files.com/cve-2024-10126/
-
M-Files Security Advisory vom 2024-11-19
https://product.m-files.com/cve-2024-10127/