Skip to main content

Application Automation Tools CVE-2024-4690

MEDIUM
Improper Restriction of XML External Entity Reference (CWE-611)
2024-10-16 security@opentext.com
XXE Application Automation Tools
5.1
CVSS 4.0 · Vendor: opentext
Share

Severity by source

Vendor (opentext) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green

Primary rating from Vendor (opentext) · only source for this CVE.

CVSS VectorVendor: opentext

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
N

Lifecycle Timeline

1
CVE Published
Oct 16, 2024 - 17:15 cve.org
MEDIUM 5.1

DescriptionCVE.org

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.

AnalysisAI

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.1.0 and below. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.1.0 and below. Affected products include: Microfocus Application Automation Tools.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

More in Application Automation Tools

View all
CVE-2021-22513 MEDIUM
6.5 Apr 08

Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. Rated medium se
CVE-2021-22512 MEDIUM
6.5 Apr 08

Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. Rat
CVE-2021-22511 MEDIUM
6.5 Apr 08

Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. Rated
CVE-2021-22510 MEDIUM
6.1 Apr 08

Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. Rated medium severity (
CVE-2024-4189 MEDIUM
5.9 Oct 16

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD

CVE-2024-4184 MEDIUM
5.9 Oct 16

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD

CVE-2024-4692 LOW
1.8 Oct 16

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allow
CVE-2024-4211 LOW
1.8 Oct 16

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allow

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique XXE

View all
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2013-5014 HIGH POC
7.5
CVE-2015-0923 MEDIUM POC
5.0
CVE-2014-0644 HIGH POC
7.8

Share

CVE-2024-4690 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy