CVE-2024-4189 is a high severity (CVSS 8.0) DTD injection flaw in OpenText Application Automation Tools. It is the companion to CVE-2024-4184: same product, same affected range of 24.1.0 and below, same score, but a separate vendor article. Update the plugin and confirm the fixed build in knowledge base article KM000033547.
What's affected
The NVD record lists OpenText Application Automation Tools 24.1.0 and below, with Jenkins as the target software in the CPE data. The published date is 16 October 2024, the same date as its sibling.
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so a low privilege account and a user action are needed, and impact is high on all three security properties. The record is not flagged as exploited in the wild.
The record text for this CVE matches CVE-2024-4184 word for word, and only the vendor article number differs (KM000033547 here, KM000033540 there). The record does not explain the split between the two. If your assessment needs the difference, the vendor articles are where it will be.
How to check if you're exposed
Check the plugin version on each Jenkins controller under Manage Jenkins and Plugins. Because both CVEs share the same affected range, one inventory pass covers them both.
Compare the version against the fix named in KM000033547. If your org tracks plugin versions in a configuration file, search for the plugin identifier there and across any Docker images that bake plugins in. Old controller images are a common place for a forgotten vulnerable plugin to live.
Plan a rescan after the update so your tracker shows both CVE ids closed. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related entries.
What to do now
- Add this CVE to the same ticket as CVE-2024-4184 so one change fixes both.
- Read vendor article KM000033547 for the fixed version and any extra steps.
- Update the plugin in your baseline image or plugin list, not only on the live controller.
- Restart Jenkins and confirm the version in the plugin manager.
- Close both CVE ids in your tracker after a rescan shows neither.
Why it matters
Both flaws belong to CWE-611, XML external entity handling. Two entries for one product in the same week is a reminder that a fix for XML parsing often has to be applied in more than one place. The record does not say whether that is the case here.
For defenders the lesson is practical. When a vendor ships paired fixes, do not stop at the first article. Read each one and map it to your own inventory so that you close both ids.
Quick check
Is one update enough for both CVEs?
The record gives the same affected range for both, so a version past 24.1.0 is the likely target, but confirm in both vendor articles.
Sources
- OpenText knowledge base article KM000033547, listed in the NVD record. The portal only returned a loading shell, so this review relies on the NVD record text.
- Safeguard Gold entry for CVE-2024-4189
Last reviewed: 19 October 2026.
