CVE-2024-4211 Multiple missing permission checks
Users with read permissions can enumerate ALM server names, usernames, and client IDs due to missing permission checks in OpenText Application Automation Tools.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-4211?
CVE-2024-4211 is a low-severity missing authorization vulnerability in OpenText Application Automation Tools, published on 16 Oct 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels.
Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate ALM server names, usernames and client IDs configured to be used with ALM servers.
This issue affects OpenText Application Automation Tools: 24.1.0 and below.
Weakness: CWE-280
Which versions are affected by CVE-2024-4211?
It affects 1 product.
Products include Microfocus Application Automation Tools.
How do I fix CVE-2024-4211?
No fix has been published for CVE-2024-4211 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-4211 being exploited?
There is no known exploitation of CVE-2024-4211 in the wild and no public exploit code.
Other vulnerabilities in OpenText Application Automation Tools
- CVE-2021-22511 SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
- CVE-2021-22512 CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
- CVE-2021-22513 Missing permission checks in Micro Focus Application Automation Tools Plugin
- CVE-2021-22510 Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
- CVE-2024-4184 Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools
Sources
Also known as GHSA-qrr4-q9rq-pfvg.