CVE-2024-39847CWE-611

Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP

High · published April 30, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-04-30T07:10Z
EPSS history
Timeline
  • 30 APR 07:10Z
    Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP
    cvelistv5