CVE-2024-4690 is a high severity XML external entity flaw in OpenText Application Automation Tools, the Jenkins integration formerly published under the Micro Focus name. It affects version 24.1.0 and below and scores 8.0. The vendor article is the place to confirm the fixed release.
What's affected
The record says the issue affects OpenText Application Automation Tools 24.1.0 and below. The CPE entry points at the Jenkins variant of the product. The weakness is CWE-611, improper restriction of XML external entity references, and the record notes it allows DTD injection.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. That reads as network reachable, low privileges needed, and a user action required. The KEV flag is false.
The only reference in the record is a vendor knowledge base article. I could not read its contents when preparing this post, because the page needs a browser session. So I cannot confirm the fixed version number. Open the article, read the fixed version, and treat anything above 24.1.0 as your starting point only after you have confirmed it there.
How to check if you're exposed
The product runs as a plugin on a Jenkins controller. In the Jenkins UI:
- Go to Manage Jenkins, then Plugins, then Installed plugins.
- Search for Application Automation Tools.
- Read the installed version. If it is 24.1.0 or lower, you are in the affected range.
If you run many controllers, list plugins in bulk with the Jenkins script console or the plugin manager CLI, and compare the output to the range above. Also check build agents and any staging controllers, because they are often forgotten.
An SBOM or dependency inventory makes this a one query job. The free scan at gold.safeguard.sh/scan takes a manifest in the browser, though Jenkins plugins are usually installed from the update center rather than declared in a manifest, so an inventory of controller plugins is still worth keeping.
What to do now
- Identify every Jenkins controller with the plugin installed and its version.
- Read the vendor article and note the fixed release.
- Update the plugin through the Jenkins update center or your plugin pinning file.
- Restart the controller as the update requires and confirm the new version.
- Review who can configure jobs or upload XML based content. The vector says low privileges are enough.
- Rebuild any plugin lists in your configuration as code files so the old version does not return.
Why it matters
XML parsers can be told to fetch other resources while they read a document. When the parser follows those instructions from untrusted input, an attacker can read local files, reach internal services, or cause trouble for the host. That is the class behind CWE-611. The usual defence is to turn off DTD and external entity processing in the parser.
CI servers deserve extra care. They hold credentials, signing keys and deploy rights, so a flaw that needs only low privileges and one click on a build server is worth a quick patch. High confidentiality, integrity and availability impact in the vector reflects that.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions are affected?
The record says 24.1.0 and below. Confirm the fixed version in the vendor article, since the record does not state it.
Does this need a login?
The vector shows low privileges required and user interaction required, so an attacker needs some access and a victim action.
Sources
- Vendor knowledge base article (page could not be read in full, so confirm details there)
- NVD record data for CVE-2024-4690
Last reviewed: 19 October 2026.
