CVE-2024-3969 HIGH

CVE-2024-3969: XML External Entity injection vulnerability in iManager

Vendor Opentext

Product iManager

Weakness CWE-611 · XXE

Published May 28, 2024

Last update August 21, 2024

View on NVD All CVEs

CVSS base score

7.8/10

Attack vector Local

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload

Key dates

02Disclosure timeline

May 28, 2024 CVE published

August 21, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-3969 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/611.html

Related vulnerabilities

04Related CVE

CVE-2024-2374 XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service CVE-2020-1693 CVE-2023-36419 Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability CVE-2023-48362 Apache Drill: XXE Vulnerability in XML Format Reader CVE-2025-2365 crmeb_java WeChatMessageController.java webHook xml external entity reference