Low severity · published Oct 16, 2024
CVE-2024-4692
Multiple missing permission checks
2.4
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels.
Multiple missing permission checks - Service Virtualization config has been discovered in in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate Service Virtualization server names.
This issue affects OpenText Application Automation Tools: 24.1.0 and below.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
OpenText Application Automation Tools · OpenText
24.1.0 and below · source: vendor
AA
Application Automation Tools · Microfocus
before 24.1.0 · source: NVD
Affected product
OA
OpenText Application Automation Tools
OpenText
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4692
Vendor Advisory
https://portal.microfocus.com/s/article/KM000033546?language=en_US
More from OpenText Application Automation Tools
8.0
CVE-2024-4690
Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools
8.0
CVE-2024-4189
Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools
8.0
CVE-2024-4184
Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools
2.4
CVE-2024-4211
Multiple missing permission checks