CVE-2024-4690 - Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools

Back Back to CVE browser

MEDIUM

Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools

Published Oct 16, 2024

5.1

MEDIUM

CVSS 4.0

EPSS 0.40%

Description

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.

Affected products

Vendor OpenText Product OpenText Application Automation Tools Default
unaffected
- Version
  24.1.0 and below
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenText

OpenText Application Automation Tools

unaffected

Version	Status	Constraints
24.1.0 and below	affected	-

Remediation

Vendor solution

Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:

Weaknesses (1)

CWE-611

XXE

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44290
Advisory
https://portal.microfocus.com/s/article/KM000033548?language=en_US
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44290		Advisory
https://portal.microfocus.com/s/article/KM000033548?language=en_US		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner OpenText

Published Oct 16, 2024

Updated Oct 16, 2024

Reserved May 9, 2024

Link CVE-2024-4690

CISA Vulnrichment

Updated Oct 16, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-4690

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-4690

ENISA EUVD

Assigner OpenText

Published Oct 16, 2024

Updated Oct 16, 2024

Exploited since n/a

Link EUVD-2024-44290

EUVD-2024-44290