CVE-2024-4690: Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools
Published Oct 16, 2024
·Updated
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
Affected Software
1 affected component
MicroFocus Application Automation Tools Jenkins<=24.1.0
Remediation
Information
Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:
Event History
Oct 16, 2024
CVE Published
via MITRE·04:41 PM
Data Sourced
via MITRE·04:41 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-4690?
CVE-2024-4690 is classified as a high-severity vulnerability due to its potential for DTD injection.
2
How do I fix CVE-2024-4690?
To fix CVE-2024-4690, upgrade OpenText Application Automation Tools to version 24.1.1 or later.
3
What is DTD Injection in the context of CVE-2024-4690?
DTD Injection is a vulnerability that allows an attacker to inject malicious DTDs into an XML document, potentially leading to data exposure.
4
Which versions of OpenText Application Automation Tools are affected by CVE-2024-4690?
CVE-2024-4690 affects OpenText Application Automation Tools version 24.1.0 and below.
5
Is there a workaround for CVE-2024-4690 before patching?
There is no specific workaround for CVE-2024-4690; updating to a fixed version is recommended.