CVE-2024-4690 Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools
Attackers can exploit XML External Entity injection in OpenText Application Automation Tools to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-4690?
CVE-2024-4690 is a medium-severity vulnerability in OpenText Application Automation Tools, published on 16 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
Weakness: CWE-611
Which versions are affected by CVE-2024-4690?
It affects 1 product.
Products include Microfocus Application Automation Tools.
How do I fix CVE-2024-4690?
No fix has been published for CVE-2024-4690 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-4690 being exploited?
There is no known exploitation of CVE-2024-4690 in the wild and no public exploit code.
Other vulnerabilities in OpenText Application Automation Tools
- CVE-2021-22511 SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
- CVE-2021-22512 CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
- CVE-2021-22513 Missing permission checks in Micro Focus Application Automation Tools Plugin
- CVE-2021-22510 Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
- CVE-2024-4184 Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools
Sources
Also known as GHSA-vfmw-mcw8-m32f.