Skip to main content

Perforce CVE-2024-3930

CRITICAL
Improper Restriction of XML External Entity Reference (CWE-611)
2024-07-30 security@puppet.com
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 30, 2024 - 19:15 nvd
CRITICAL 9.8

DescriptionNVD

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered.

AnalysisAI

In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Affected products include: Perforce Akana Api. Version information: prior to 2024.1.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

CVE-2015-8965 CRITICAL
9.8 Apr 06

Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that

CVE-2026-85978 CRITICAL
10.0 Sep 09

Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Polic

CVE-2023-45849 CRITICAL
9.8 Nov 08

An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2.

CVE-2026-89212 CRITICAL
9.2 Sep 11

XML external entity (XXE) injection in Perforce's Akana API Platform allows remote unauthenticated attackers to abuse im

CVE-2021-28973 MEDIUM POC
4.9 Apr 13

The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input dat

CVE-2026-6043 HIGH
8.8 Apr 24

Helix Core Server (P4D) before 2026.1 ships with insecure default configurations allowing remote unauthenticated attacke

CVE-2026-14254 HIGH
8.3 Jul 16

Brute-force protection bypass in Perforce Delphix Continuous Data lets remote attackers defeat the account lockout mecha

CVE-2024-0325 HIGH
7.8 Feb 01

In Helix Sync versions prior to 2024.1, a local command injection was identified. Rated high severity (CVSS 7.8), this v

CVE-2026-6902 HIGH
7.7 May 18

Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows

CVE-2024-5249 HIGH
7.5 Jul 30

In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. Rated high severity (CVSS 7.5), this v

CVE-2023-5759 HIGH
7.5 Nov 08

In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified.

CVE-2023-45319 HIGH
7.5 Nov 08

In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was id

Share

CVE-2024-3930 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy