CVE-2024-39586

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially exploit this vulnerability, leading to information disclosure.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Oct 9, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-395897.5Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a3CVE-2024-39596.5An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and CVE-2024-395907.5Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a3CVE-2024-395915.3SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges cCVE-2024-395926.5Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This aCVE-2024-395935.7SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. SuccessfCVE-2024-395946.1SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in ReflCVE-2024-395955.4SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in StorCVE-2024-395964.3Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be CVE-2024-395977.2In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early lCVE-2024-395987.7SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by speciallCVE-2024-395994.7Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured
CVE-2024-39586: Medium severity, CVSS 4.3 | Vulnix