PT-2024-32283 · Opentext · Opentext Application Automation Tools

Published 2024-10-16 · Updated 2024-10-21 · CVE-2024-4692

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenText Application Automation Tools versions 24.1.0 and below

Description The issue is related to improper validation of specified quantity in input, allowing exploitation of incorrectly configured access control security levels. Multiple missing permission checks have been discovered in the Service Virtualization configuration, which could allow users with Overall/Read permission to enumerate Service Virtualization server names.

Recommendations For OpenText Application Automation Tools versions 24.1.0 and below, update to a version above 24.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the Service Virtualization configuration to minimize the risk of exploitation. Avoid using the Overall/Read permission for users who do not require it, until the issue is resolved.

Fix

Weakness Enumeration

CWE-280

Related Identifiers

CVE-2024-4692

Affected Products

Opentext Application Automation Tools

References · 7

• https://osv.dev/vulnerability/CVE-2024-4692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4692 · Security Note
• https://portal.microfocus.com/s/article/KM000033546?language=en_US · Vendor Advisory
• https://t.me/cvenotify/98996 · Telegram Post
• https://twitter.com/CVEnew/status/1846609962807841079 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846775204120301914 · Twitter Post
• https://t.me/cvedetector/8095 · Telegram Post