CVE-2024-0315 is a medium severity (CVSS 6.6) remote file inclusion weakness in FireEye Central Management. No fixed version is confirmed in the record, so check the vendor or project page. It is not listed as exploited in the wild by CISA.
What's affected
Central Management 9.1.1.956704 from FireEye. The description says the flaw lets an attacker upload a malicious PDF file to the system during the report creation process.
The weakness is mapped to CWE-98, improper control of a filename used in a PHP include or require. The record was published on 2024-01-15. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
How to check if you're exposed
This is software you install yourself or an appliance, so start from your own inventory. Find where the product runs, read its version from the application, its package metadata or its install directory, and compare it to the range above.
grep -ril "'+d['short'].split('-')[0]+'" /var/www 2>/dev/null
That searches a typical web root for the product name, so adjust the path to your server. For code you maintain, search for the file and parameter named in the record and read how the value is used.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of FireEye Central Management in your environment, including test systems and anything bought or installed by a team outside IT.
- Check the vendor or project page for a fixed release. None is confirmed in the record, so do not assume that upgrading to the latest version resolves it until the notes say so.
- Restrict who can create reports on the appliance.
- Keep the management interface on a trusted network.
- Contact the vendor for the fixed release and document the date you applied it.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
Remote file inclusion weaknesses come from code that builds a file path or location from input and then loads it. The record describes the issue in terms of a malicious PDF being uploaded during report creation.
The public description is brief. FireEye products are appliances and agents, so the right step is to follow the vendor guidance and not to wait for scanning to flag it.
The CVSS vector reads as follows. The attack is possible with local access, attack complexity is low, privileges required are low, and user interaction is not needed. The impact on confidentiality, integrity and availability is high, limited and limited respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. Check the vendor advisory for current status.
Which versions are fixed?
No fixed version is confirmed in the record, so check the vendor or project page.
Sources
The vendor and researcher references listed in the NVD record could not be retrieved when this post was written, so the details above come from the NVD record itself.
Last reviewed: 19 October 2026.
