CVE-2024-10127: 
M-Files Server vulnerability analysis and mitigation

Authentication bypass vulnerability (CVE-2024-10127) affects M-Files server versions before 24.11 in LDAP authentication configurations. The vulnerability allowed user authentication without a password when the LDAP server had a vulnerable configuration that supported anonymous binding (M-Files Advisory).

The vulnerability has been assigned a CVSS v4.0 score of 9.2 (CRITICAL) with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. It is categorized under CWE-303 (Incorrect Implementation of Authentication Algorithm). The vulnerability specifically relates to the LDAP authentication implementation that incorrectly handled configurations supporting anonymous binding (NVD, M-Files Advisory).

The vulnerability could allow attackers to gain unauthorized access to the M-Files server without providing a password if the LDAP server is misconfigured to allow anonymous binding (Security Online).

The vulnerability can be remediated by updating the M-Files server to version 24.11 or later. For LTS users, version 24.8 SR2 (24.8.13981.13) and later are also not affected by this vulnerability (M-Files Advisory).