CVE-2024-4184 is a high severity (CVSS 8.0) XML external entity flaw in OpenText Application Automation Tools, formerly distributed under the Micro Focus name. The record says versions 24.1.0 and below are affected and describes it as DTD injection. Update to a release newer than 24.1.0 and confirm the build in the vendor article.
What's affected
The NVD record states the issue affects OpenText Application Automation Tools 24.1.0 and below. The CPE entry names Jenkins as the target software, so the product in scope is the Jenkins plugin form of the tools. If you use other builds of the tools, ask the vendor.
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. An attacker needs a low privilege account and some user interaction, and the stated impact is high across confidentiality, integrity and availability. KEV status in the record is false.
The record does not name a fixed version. The vendor article KM000033540 is the reference to check. A second CVE, CVE-2024-4189, was published the same day with the same description and its own article, KM000033547, so review both together.
How to check if you're exposed
In Jenkins, open Manage Jenkins, then Plugins, then Installed plugins, and look for the OpenText or Micro Focus Application Automation Tools entry. Read its version. 24.1.0 or lower is in scope.
If you manage many Jenkins controllers, list plugins in bulk. The Jenkins script console or your configuration as code repository can print plugin names and versions, and pinned plugin lists in a plugins.txt file are even easier to search. Run these only on controllers you administer.
Also note who can configure jobs that use the tool, because the vector asks for a privileged but not administrative account. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related entries.
What to do now
- Find every Jenkins controller that has the Application Automation Tools plugin installed.
- Read the plugin version and mark anything at 24.1.0 or below.
- Open vendor articles KM000033540 and KM000033547 and note the fixed version they give.
- Update the plugin on a test controller first, then roll it out and restart Jenkins.
- Review who holds job configuration permission and remove it where it is not needed.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity reference. An XML parser that processes a document type definition from untrusted input can be told to read local files, make network requests or consume resources. The usual fix is to turn off DTD and external entity handling in the parser, which is a configuration change in code rather than something a user can toggle.
CI servers are rich targets. They hold build credentials, signing keys and deploy tokens, and a flaw that reads server files can reach all of them. A plugin vulnerability is also easy to miss because plugin lists rarely get the review that application dependencies do.
Quick check
Why are there two CVEs with the same description?
The record lists separate OpenText articles for CVE-2024-4184 and CVE-2024-4189 but identical text. Treat them as two entries to close out, and read both articles.
Sources
- OpenText knowledge base article KM000033540, listed in the NVD record. The portal only returned a loading shell, so this review relies on the NVD record text.
- Safeguard Gold entry for CVE-2024-4184
Last reviewed: 19 October 2026.
