CVE-2024-4211

Name of the Vulnerable Software and Affected Versions OpenText Application Automation Tools versions 24.1.0 and below

Description The issue is related to improper validation of specified quantity in input, allowing exploitation of incorrectly configured access control security levels. Multiple missing permission checks have been discovered in the ALM job configuration, which could enable users with Overall/Read permission to enumerate ALM server names, usernames, and client IDs configured for use with ALM servers.

Recommendations For versions 24.1.0 and below, consider restricting access to the ALM job configuration to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the permissions of users with Overall/Read access to prevent enumeration of sensitive information.