« Volver al listado

CVE-2024-0563

Estado: ModificadaMedia (6.5)—

Denial of service condition in M-Files Server in versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service against other anonymous users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

M-files — M-files Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-0563",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-0563",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-23T19:30:11.634119Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@m-files.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@m-files.com",
      "affectedData": [
        {
          "vendor": "M-Files Corporation",
          "product": "M-Files Server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "24.2",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "23.2 SR7"
            },
            {
              "status": "unaffected",
              "version": "23.8 SR5"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-02-23T09:15:22.263",
  "references": [
    {
      "url": "https://empower.m-files.com/security-advisories/CVE-2024-0563",
      "source": "security@m-files.com"
    },
    {
      "url": "https://product.m-files.com/security-advisories/cve-2024-0563/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@m-files.com"
    },
    {
      "url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-0563/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@m-files.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Denial of service condition in M-Files Server in versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service against other anonymous users."
    },
    {
      "lang": "es",
      "value": "La condición de denegación de servicio en M-Files Server en versiones anteriores a la 24.2 (excluyendo 23.2 SR7 y 23.8 SR5) permite a un usuario anónimo provocar una denegación de servicio contra otros usuarios anónimos."
    }
  ],
  "lastModified": "2026-06-17T06:53:47.313",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:m-files:m-files_server:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9735591F-6BE0-4B7C-B9C0-525468880E06",
              "versionEndExcluding": "23.2.12340.6"
            },
            {
              "criteria": "cpe:2.3:a:m-files:m-files_server:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6228200D-F2B7-40C8-B666-4241FD3A59E7",
              "versionEndExcluding": "23.8.12892.6",
              "versionStartExcluding": "23.2.12340.6"
            },
            {
              "criteria": "cpe:2.3:a:m-files:m-files_server:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A0E06A5-DE4C-4FA6-B55C-7806CEC11FAB",
              "versionEndExcluding": "23.8.12892.17",
              "versionStartIncluding": "23.2.12340.6"
            },
            {
              "criteria": "cpe:2.3:a:m-files:m-files_server:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65C5CBAB-EA68-4881-AE65-86FEB854AA3E",
              "versionEndExcluding": "24.2.13421.8",
              "versionStartExcluding": "23.8.12892.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@m-files.com"
}