Back to Database
Status published
High
CVE-2024-39847
Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP
Vulnerability Description
Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-39847
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Marcelo Reyes of SCHUTZWERK GmbH
Affected Vendor
Affected Software
4D Server
Vulnerable Versions:
*, v20 R4, v20 R7
Timeline
Official Publish:
April 30th, 2026
Last Modified:
May 17th, 2026
Added to House:
July 22nd, 2026