CVE-2024-39847
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Apr 30, 2026
CISA due date
—
The record
Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89260 MoguBlog through 6.2 contains an XML external entity injection vulnerability in the… CWE-611
- CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of… CWE-611
- CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribution… CWE-611
- CVE-2026-19614 The API is prone to XML external entity (XXE) injection. CWE-611
- CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexus… CWE-611
- CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from… CWE-611
- CVE-2026-17444 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611
- CVE-2026-17443 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611