How severe is CVE-2024-4692?

CVE-2024-4692 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-4692 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-4692?

CVE-2024-4692 affects Microfocus Application Automation Tools. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-4692?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-4692 have an EU (EUVD) identifier?

Yes. CVE-2024-4692 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-44291.

When was CVE-2024-4692 published?

CVE-2024-4692 was published on 2024-10-16 and last updated on 2026-06-17.

CVE-2024-4692

CVE-2024-4692 is a low-severity vulnerability in Microfocus Application Automation Tools with a CVSS 3.x base score of 2.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-280.

Key facts

Severity: Low (CVSS 3.x base score 2.4)
CVSS v4: 1.8
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-44291
Weakness: CWE-280
Affected product: Microfocus Application Automation Tools
Published: 2024-10-16
Last modified: 2026-06-17

Description

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - Service Virtualization config has been discovered in in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate Service Virtualization server names. This issue affects OpenText Application Automation Tools: 24.1.0 and below.

Frequently asked questions

What is CVE-2024-4692?: Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - Service Virtualization config has been discovered in in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate Service Virtualization server names. This issue affects OpenText Application Automation Tools: 24.1.0 and below.
How severe is CVE-2024-4692?: CVE-2024-4692 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-4692 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-4692?: CVE-2024-4692 affects Microfocus Application Automation Tools. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-4692?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-4692 have an EU (EUVD) identifier?: Yes. CVE-2024-4692 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-44291.
When was CVE-2024-4692 published?: CVE-2024-4692 was published on 2024-10-16 and last updated on 2026-06-17.

References

https://portal.microfocus.com/s/article/KM000033546?language=en_US

Affected products (1)

cpe:2.3:a:microfocus:application_automation_tools:*:*:*:*:*:jenkins:*:*

More vulnerabilities in Microfocus Application Automation Tools

CVE-2024-4690 — High (CVSS 8.0): Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD…
CVE-2024-4189 — High (CVSS 8.0): Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD…
CVE-2024-4184 — High (CVSS 8.0): Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD…
CVE-2021-22513 — Medium (CVSS 6.5): Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The…
CVE-2021-22512 — Medium (CVSS 6.5): Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin.…
CVE-2021-22511 — Medium (CVSS 6.5): Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The…

All CVEs affecting Microfocus Application Automation Tools →

Other CWE-280 vulnerabilities

CVE-2025-46066 — Critical (CVSS 9.9): An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges
CVE-2025-6573 — Critical (CVSS 9.8): Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from…
CVE-2024-24116 — Critical (CVSS 9.8): An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the…
CVE-2026-41566 — Critical (CVSS 9.4): Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks. This issue affects Apache…
CVE-2024-1608 — Critical (CVSS 9.1): In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could…
CVE-2026-24096 — High (CVSS 8.8): Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version…

Browse all CWE-280 vulnerabilities →