CVE-2024-51163

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-20 · updated 2026-06-17
Weakness: CWE-200

Description

A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive information through the print label function. Specifically, the filePathList parameter is susceptible to LFI, enabling a malicious user to include files from the web server, such as web.config or /etc/host, leading to the disclosure of sensitive information.

Affected products

Vegam Solutions Vegam 4I: before 6.3.47.0 — fixed in 6.3.47.0

How to fix

Upgrade to a fixed version: Vegam Solutions Vegam 4I 6.3.47.0. Check the vendor advisory for mitigations.

References

https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-51163
https://github.com/rahulkadavil/CVEs/tree/main/CVE-2024-51163

Get alerted when CVE-2024-51163 or the next vulnerability affects your stack