Login Request a demo
Low severity · published Oct 16, 2024
CVE-2024-4211
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security…
2.4
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate ALM server names, usernames and client IDs configured to be used with ALM servers. This issue affects OpenText Application Automation Tools: 24.1.0 and below.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Application Automation Tools · Microfocus
through 24.1.0 · source: NVD
Affected product
AA
Application Automation Tools
Microfocus
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4211
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4211
Vendor Advisory
https://portal.microfocus.com/s/article/KM000033543?language=en_US
More from Application Automation Tools
8.0
CVE-2024-4690
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application…
8.0
CVE-2024-4189
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application…
8.0
CVE-2024-4184
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application…
6.5
CVE-2021-22513
Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin
6.5
CVE-2021-22512
Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin