CVE-2024-3930 is a medium severity XML external entity (XXE) flaw in Perforce Akana API Platform, scored 6.3 by NVD. Versions before 2024.1.0 are affected. Upgrade to 2024.1.0 or later and read the Perforce advisory for any extra steps.
What's affected
The record says versions of Akana API Platform prior to 2024.1.0 are affected, so 2024.1.0 is the first version without the flaw. The description is short and gives no component, endpoint or exploitation detail, so this post does not guess at them.
The NVD vector rates the attack as network based with low privileges, which means an attacker needs some form of access, and the impact on confidentiality, integrity and availability is low in each case. Perforce's advisory, linked from the record, is the place to look for platform specific notes. This write-up did not fetch it.
The KEV flag is false and nothing in the record reports exploitation in the wild.
The NVD record is dated 2024-07-30 and carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, a score of 6.3 (Medium). Weakness class: CWE-611.
How to check if you're exposed
Find the Akana API Platform version in the administration console or in the product's version file or package list for your installation. Compare it with 2024.1.0.
If you run several environments, such as development, test and production gateways, check each one, because older test instances are often forgotten. Also list which services in the platform accept XML input, since XML parsing is where this class of flaw lives. Services that take only JSON are less likely to be involved, though only the vendor advisory can confirm scope.
What to do now
- Record the Akana version in every environment.
- Upgrade to 2024.1.0 or later, following the Perforce upgrade guidance.
- Read the Perforce advisory linked in the sources for scope and any interim mitigation.
- Limit which users and networks can submit XML to the platform until the upgrade is done.
- Where the product allows it, confirm that XML parsers have external entity and DTD processing disabled.
Why it matters
The weakness is XML external entity injection, CWE-611. An XML parser that allows external entities can be told by the document to fetch a file or a URL and fold the result into its output. Depending on the setup, that can expose local files or let the server make requests it should not.
The fix pattern is the same across products: turn off external entity resolution and document type definitions in the parser unless a feature truly needs them. API gateways parse a great deal of untrusted XML, so this class of bug turns up there often, and the score here is moderate because the record sets each impact rating to low.
Quick check
Which Akana version fixes CVE-2024-3930?
Versions prior to 2024.1.0 are affected, so 2024.1.0 or later is the target.
Is it exploited in the wild?
The record's KEV flag is false and the record reports no exploitation.
Sources
Last reviewed: 19 October 2026.
