Low severity · published Oct 16, 2024
CVE-2024-4211
Multiple missing permission checks
2.4
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels.
Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate ALM server names, usernames and client IDs configured to be used with ALM servers.
This issue affects OpenText Application Automation Tools: 24.1.0 and below.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
OpenText Application Automation Tools · OpenText
24.1.0 and below · source: vendor
AA
Application Automation Tools · Microfocus
through 24.1.0 · source: NVD
Affected product
OA
OpenText Application Automation Tools
OpenText
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4211
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4211
Vendor Advisory
https://portal.microfocus.com/s/article/KM000033543?language=en_US
More from OpenText Application Automation Tools
8.0
CVE-2024-4690
Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools
8.0
CVE-2024-4189
Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools
8.0
CVE-2024-4184
Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools
2.4
CVE-2024-4692
Multiple missing permission checks