CVE-2024-39847 — Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP

CVE-2024-39847

Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP PUBLISHED

Description (CNA)

Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

Affected (CNA)

Vendor / product	Versions
4D / 4D Server	affected * through v20 R3; unknown v20 R4 through v20 R6; unaffected v20 R7

CWE

CWE-611

References

https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/
https://4d.com

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2026/May/0