CVE-2024-10126

Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read server local files of a limited set of filetypes via document preview.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
M-Files CorporationCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
VendorProductVersion
m-filesm-files_server
𝑥
< 23.8.12892.6
m-filesm-files_server
𝑥
< 23.8.12892.23
m-filesm-files_server
24.2.13421.11 ≤
𝑥
< 24.2.13421.17
m-filesm-files_server
24.8.13981.8 ≤
𝑥
< 24.8.13981.11
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://product.m-files.com/security-advisories/CVE-2024-10126