Invalid Permission Checks in ALM Job Configuration Could Allow Access to Sensitive Data
CVE-2024-4211

2.4LOW

Key Information:

Vendor
OpenText
Status
Application Automation Tools
Vendor
CVE Published:
16 October 2024

Summary

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels.

Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate ALM server names, usernames and client IDs configured to be used with ALM servers.

This issue affects OpenText Application Automation Tools: 24.1.0 and below.

References

https://portal.microfocus.com/s/article/KM000033543?langu...

CVSS V3.1

Score:
2.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.