title: In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs.
description: In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.
problem types: CWE-532 Information Exposure Through Log Files
affected:
{
product: M-Files Server
vendor: M-Files
versions:
lessThan: 21.11.10775.0, status: affected, version: Online, versionType: custom
lessThan: 21.11.10775.0, status: affected, version: 2018, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
]
solutions: Upgrade to M-Files version 21.11.10775.0 or newer.