Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00085.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-33747 Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect calculation of effective permissions.
Fixes

Solution

Update to patched version

Workaround

No workaround given by the vendor.

References
Link Providers
https://product.m-files.com/security-advisories/CVE-2024-11176 cve-icon cve-icon
History

Thu, 21 Aug 2025 20:30:00 +0900

Type Values Removed Values Added
Weaknesses CWE-682

Thu, 21 Aug 2025 19:30:00 +0900

Type Values Removed Values Added
Description Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect calculation of effective permissions. Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions.
Title Incorrect calculation of effective permissions in M-Files Aino Incorrect evaluation of effective permissions in M-Files Aino

Fri, 22 Nov 2024 00:15:00 +0900

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N'}

Thu, 21 Nov 2024 06:15:00 +0900

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 20 Nov 2024 17:45:00 +0900

Type Values Removed Values Added
Description Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect calculation of effective permissions.
Title Incorrect calculation of effective permissions in M-Files Aino
Weaknesses CWE-682
CWE-732
CWE-863
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: M-Files Corporation

Published:

Updated: 2025-08-21T10:11:39.156Z

Reserved: 2024-11-13T12:43:58.287Z

Link: CVE-2024-11176

cve-icon Vulnrichment

Updated: 2024-11-20T20:22:03.013Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-11-20T09:15:04.447

Modified: 2025-08-21T11:15:28.647

Link: CVE-2024-11176

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses